0

quick question regarding fail2ban filter regex problem I have a log pattern:

2018-02-06 07:40:20,954 fail2ban.actions [26058]: NOTICE [postfix-sasl] Ban 192.168.2.14

I try to Ban IP (192.168.2.14) following filter:

failregex = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3} ([a-z])\w+.([a-z])\w+ [\d]: NOTICE [([a-z])\w+-([a-z])\w+] Ban *

So far no luck. fail2ban-regex listed missing line

I am sure it is a simple error somewhere in the middle.

Any help appreciated

  • 1
    You have already banned this IP address. Banning it again is pointless. – Michael Hampton Feb 11 '18 at 3:17
1

I'm not sure why you would like to block an IP with fail2ban that has been blocked already with fail2ban, but anyway …

I see two issues why your fail2ban filter does not work.

  1. You don't have a <HOST> tag within your failregex line.

    Replace * at the end of your failregex line by <HOST>. This will tell fail2ban witch part of a log file line represents the IP to ban.

  2. Your regex is not correct.

    Replace

    ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3} ([a-z])\w+.([a-z])\w+ [\d]: NOTICE [([a-z])\w+-([a-z])\w+] Ban <HOST>
    

    by

    ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3} \w+\.\w+ \[.*\]: NOTICE \[\w+\-\w+\] Ban <HOST>
    

    or even more simply expressed

    ^\.* Ban <HOST>$
    

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.