2

I'm trying to create a failregex in Fail2ban to find these lines ( and IP addresses ), but I can't write it.

My log lines looks like these:

[Thu Sep 22 10:28:32.215159 2016] [:error] [pid 1616] [client 83.143.240.13:54895] FastCGI: server "/var/www/cgi-bin/php5-fcgi-104.236.209.45-80-blogginger.com" stderr: PHP message: WP login failed for username: admin, referer: http://blogginger.com/wp-login.php

[Thu Sep 22 04:38:01.588441 2016] [:error] [pid 24937] [client 49.151.91.8:58121] FastCGI: server "/var/www/cgi-bin/php5-fcgi-104.236.209.45-80-blogginger.com" stderr: PHP message: WP login failed for username: admin, referer: http://blogginger.com/wp-login.php

And this is my failregex line in attack.conf:

failregex = [[]client <HOST>[]] WP login failed.*

But it doesn't work. There is not any match.

What is the correct failregex line for find these log lines?

Thank you!

2

Try

failregex = \[client <HOST>:\d+\] .* WP login failed

You can use the fail2ban-regex utility to test regexes against example input files. That's a lot quicker and easier than trying to do this with the live logs.

  • I upgraded the server, and log has been changed: [Mon Dec 03 07:03:18.364323 2018] [php7:notice] [pid 12662] [client 103.200.39.34:7379] WP login failed for username: admin, referer: blogginger.com/login The correct regex now is this below: [client <HOST>:\d+] .*WP login failed.* – Feriman Dec 4 '18 at 10:55
1

try with

failregex = [[]client <HOST>[]] .*WP login failed.*

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.