So I am having issues getting Fail2Ban to work with as a custom filter for a web app login. First of all, other filter do work such as NGINX Auth. However, my emails have stopped working, not sure why yet.
These are the failed login attempts in the /var/log/auth.log
Apr 1 11:28:15 user pancake: Attempt to login as random failed. 127.0.0.1 (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_4) AppleWebKit/601.5.17 (KHTML, like Gecko) Version/9.1 Safari/601.5.17) Apr 1 11:28:39 user pancake: Attempt to login as admin failed. 127.0.0.1 (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_4) AppleWebKit/601.5.17 (KHTML, like Gecko) Version/9.1 Safari/601.5.17)
My Jail (/etc/fail2ban/jail.local):
[pancake] enabled = true port = http,https filter = pancake logpath = /var/log/auth.log maxretry = 4
My filter (/etc/fail2ban/filter.d/pancak.conf)
[INCLUDES] # Read common prefixes. If any customizations available -- read them from # common.local before = common.conf [Definition] _daemon = pancake failregex = Attempt to login as .* failed. <HOST>$ ignoreregex =
Now when I test by running:
sudo fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/pancake.conf
Running tests ============= Use failregex file : /etc/fail2ban/filter.d/pancake.conf Use log file : /var/log/auth.log Results ======= Failregex: 0 total Ignoreregex: 0 total Date template hits: |- [# of hits] date format |  MONTH Day Hour:Minute:Second `- Lines: 2708 lines, 0 ignored, 0 matched, 2708 missed
I have also tried using:
failregex = ^%(__prefix_line)sAttempt to login as .* failed. <HOST>$
Any help would be great.