0

I'm trying to match wordpress failed logins and I'm struggling with fail2ban configuration.

The lines I'm trying to match look like this:

116.147.121.40 - - [26/Mar/2020:10:18:24 +0100] "POST /wp-login.php HTTP/1.1" 200 2044 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

Fail2ban-regex matches the lines only if used like this:

root@srv1:~# fail2ban-regex -v testlog.log "^<HOST>\s\-\s\-\s.*\s\"POST\s\/wp\-login\.php\sHTTP.*200" | grep Lines
Lines: 10 lines, 0 ignored, 2 matched, 8 missed

So this works and I get some matches.

Now if I use this regex in my custom filter file:

root@srv1:~# cat /etc/fail2ban/filter.d/wordpress.conf 

[INCLUDES]
before = common.conf

[Definition]
failregex = ^<HOST>\s\-\s\-\s.*\s\"POST\s\/wp\-login\.php\sHTTP.*200
ignoreregex =

... it's simply not matching anymore:

root@srv1:~# fail2ban-regex -v testlog.log /etc/fail2ban/filter.d/wordpress.conf | grep Lines
Lines: 10 lines, 0 ignored, 0 matched, 10 missed

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.