2

I'm trying to create a failregex in Fail2ban to find these lines ( and IP addresses ), but I can't write it.

My log lines looks like these:

[Thu Sep 22 10:28:32.215159 2016] [:error] [pid 1616] [client 83.143.240.13:54895] FastCGI: server "/var/www/cgi-bin/php5-fcgi-104.236.209.45-80-blogginger.com" stderr: PHP message: WP login failed for username: admin, referer: http://blogginger.com/wp-login.php

[Thu Sep 22 04:38:01.588441 2016] [:error] [pid 24937] [client 49.151.91.8:58121] FastCGI: server "/var/www/cgi-bin/php5-fcgi-104.236.209.45-80-blogginger.com" stderr: PHP message: WP login failed for username: admin, referer: http://blogginger.com/wp-login.php

And this is my failregex line in attack.conf:

failregex = [[]client <HOST>[]] WP login failed.*

But it doesn't work. There is not any match.

What is the correct failregex line for find these log lines?

Thank you!

2 Answers 2

3

Try

failregex = \[client <HOST>:\d+\] .* WP login failed

You can use the fail2ban-regex utility to test regexes against example input files. That's a lot quicker and easier than trying to do this with the live logs.

1
  • I upgraded the server, and log has been changed: [Mon Dec 03 07:03:18.364323 2018] [php7:notice] [pid 12662] [client 103.200.39.34:7379] WP login failed for username: admin, referer: blogginger.com/login The correct regex now is this below: [client <HOST>:\d+] .*WP login failed.*
    – Feriman
    Dec 4, 2018 at 10:55
1

try with

failregex = [[]client <HOST>[]] .*WP login failed.*

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .