0

I am unable to get my fail2ban fail regex to get to match to the log entries.

The following is a sample log entry:

Failed login attempt {"xForwardedFor":"192.168.0.38","remoteAddress":"::ffff:127.0.0.1","userAgent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:70.0) Gecko/20100101 Firefox/70.0","timestamp":1573556557}

This is my configuration:

[Definition]
failregex= ^Failed login attempt {\"xForwardedFor\":\"<HOST>\"
ignoreregex =
datepattern = "timestamp":{EPOCH}}$

Fail2ban does not return a match while running or when testing with fail2ban-regex as follows.

fail2ban-regex 'Failed login attempt {"xForwardedFor":"192.168.0.38","remoteAddress":"::ffff:127.0.0.1","userAgent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:70.0) Gecko/20100101 Firefox/70.0","timestamp":1573556557}' '^Failed login attempt {\"xForwardedFor\":\"<HOST>\"'
0

It seems that your log file does not begin with timestamps. Based on the Manual,

  • In order for a log line to match your failregex, it actually has to match in two parts: the beginning of the line has to match a timestamp pattern or regex, and the remainder of the line has to match your failregex. If the failregex is anchored with a leading ^, then the anchor refers to the start of the remainder of the line, after the timestamp and intervening whitespace.

  • The pattern or regex to match the time stamp is currently not documented, and not available for users to read or set. See Debian bug #491253. This is a problem if your log has a timestamp format that fail2ban doesn't expect, since it will then fail to match any lines. Because of this, you should test any new failregex against a sample log line, as in the examples below, to be sure that it will match. If fail2ban doesn't recognize your log timestamp, then you have two options: either reconfigure your daemon to log with a timestamp in a more common format, such as in the example log line above; or file a bug report asking to have your timestamp format included.

I tried your case in my machine by putting the timestamps in the beginning, Fail2Ban does recognize the pattern.

~$ sudo fail2ban-regex '1573556557 Failed login attempt {"xForwardedFor":"192.168.0.38","remoteAddress":"::ffff:127.0.0.1","userAgent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:70.0) Gecko/20100101 Firefox/70.0","timestamp":1573556557}' 'Failed login attempt {\"xForwardedFor\":\"<HOST>'
       
Running tests
=============

Use   failregex line : Failed login attempt {\"xForwardedFor\":\"<HOST>
Use      single line : 1573556557 Failed login attempt {"xForwardedFor":"...


Results
=======

Failregex: 1 total
|-  #) [# of hits] regular expression
|   1) [1] Failed login attempt {\"xForwardedFor\":\"<HOST>
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [1] {^LN-BEG}Epoch
`-

Lines: 1 lines, 0 ignored, 1 matched, 0 missed
[processed in 0.01 sec]

Maybe you can modified your log file so that the date & time can be put at the beginning. I also have another references related with your case:

Case 1

Case 2

Hopefully this helps.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.