Fail2Ban version: 0.10.2
I have tried a lot of filter config files for MongoDB remote authentication fail, none of them have been working, I have figured that the problem is with failregex and I am not able to come up with a proper regex.
{"$date":"2021-08-10T17:27:13.498+05:30"},"s":"I", "c":"ACCESS", "id":20249, "ctx":"conn187","msg":"Authentication failed","attr":{"mechanism":"SCRAM-SHA-256","speculative":true,"principalName":"Admin","authenticationDatabase":"admin","remote":"123.456.789.123:60054","extraInfo":{},"error":"AuthenticationFailed: SCRAM authentication failed, storedKey mismatch"}}
This is the mongo log I get on the failed attempt. I have tried using <HOST>, <ADDR> in the regex but the <HOST> gives 0.0.0.0 and <ADDR> gives 3:6005 (last digit of IP and 4 digits of port).
What would be the proper regex to filter this log?
Regex I have tried
^(.*Authentication failed.*)|(.*<ADDR>.*)|$
^(.*Authentication failed.*)|(.*<HOST>.*)|$