0

i can't get a regex for fail2ban to work. I want to match the following:

[Tue Jun 24 10:22:14.528987 2014] [fcgid:warn] [pid 22526:tid 139757615011584] [client IP:PORT] mod_fcgid: stderr: user admin joomla authentication failure, referer: http://www.mydomain.com/administrator/index.php?option=com_login

I tried:

^\[.*\s*.*]* \[client <HOST>\] mod_fcgid: stderr: user .* joomla authentication failure, referer: .*

Any help would be very appreciated.

  • The downvote really sucks because he is really not appropriate. – chrisK Jun 28 '14 at 21:12
0

Just 2 notes:

  • In the example we need to use an actual IP and port instead of IP:PORT, even if it is fake.
  • In the regex you need to catch the IP, and specify the port separately: <HOST>:[0-9]+. I assume the port is mandatory.

The test (last line is the regex):

fail2ban-regex \
'[Tue Jun 24 10:22:14.528987 2014] [fcgid:warn] [pid 22526:tid 139757615011584] [client 1.2.3.4:1234] mod_fcgid: stderr: user admin joomla authentication failure, referer: http://www.mydomain.com/administrator/index.php?option=com_login' \
'^\[.*]* \[client <HOST>:[0-9]+\] mod_fcgid: stderr: user .* joomla authentication failure, referer: .*'

It works for me.

  • Thank you so much! That one worked. I totally forgot to regex the port too. Shame on me. – chrisK Jun 24 '14 at 10:33
1

You don't need to have a complex regex to skip over the leading time field. I suspect that's what's causing you problems. For the log entry given this works providing I convert your IP:PORT into a numeric ip:port value.

'^.*[[]client <HOST>.*user .*joomla authentication failure,'

The above would ban any user with too many authentication failures.

I don't know if you use it but fail2ban-regex is a great tool for this

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.