ENH: filter for Tine 2.0

[lkneschke]

This change adds the needed rules for the Tine 2.0 log file.

[coveralls]

Coverage remained the same when pulling 47dd8fb on lkneschke:master into 5deb1f8 on fail2ban:master.

[grooverdan]

Thanks Lars,

few things:

does a wrong user and wrong password log identical messages?

Can you try to do a stronger regex (see https://github.com/fail2ban/fail2ban/blob/master/FILTERS for why)?

Is there some documentation that describes the format of at least the first few fields of the logs?

Can you give yourself credit in the THANKS document?

Due to its logs being in UTC format I may just merge this into the 0.9 branch (which is able to parse and understand timezones correctly) without every user having very different findtimes as a kludgy workaround..

Much appreciate your contribution.

[grooverdan]

ping, probably looking at doing a 0.9 release next week.

If you don't have much time can you tell me if usernames can contain spaces? And does a wrong user and wrong password log identical messages? (if not logs for both would be appreciated). And I can do the rest.

[lkneschke]

Thanks for the ping!

Wrong user logs this line:
8e035 ffff3 -- none -- - 2014-01-21T04:38:14+00:00 WARN (4): Tinebase_Controller::login::106 Login with username testuser from 127.0.0.1 failed (-1)!

Wrong password logs this line:
8e035 ffff3 -- none -- - 2014-01-21T04:38:14+00:00 WARN (4): Tinebase_Controller::login::106 Login with username testuser from 127.0.0.1 failed (-3)!

Only the status -1 or -3 is different.

The source code of the Tine 2.0 logger class can be found here: http://git.tine20.org/git?p=tine20;a=blob;f=tine20/Tinebase/Log/Formatter.php;h=ccfd4442bb537dea11ffa91d8d4b8cdf53bc498a;hb=HEAD

5 chars request id
optional [SPACE]
optional 5 chars json request id
[SPACE]
the login name if available, otherwise -- none --

[SPACE]

[SPACE]
the utc timestamp
[SPACE]
the debug level as string and number: DEBUG (7) ; INFO (6) ; ...
[COLON]
the log message

Usernames can contain spaces.

I would really appreciate if could take over, as I will be very busy this week and it would be great if this change can delivered with the 0.9 release.

Thanks!

[grooverdan]

beautiful. Thanks for the links and answers. Will take over and get this included before release.

Have a great week, even if a bit busy, and I'll let you know when its done.

[grooverdan]

Ok. moved to #593. If you have two more log samples with logdifftime or logruntime enable and both enabled that would be good too.

[grooverdan]

closed per #593. Still would like log samples with logdifftime/logruntime enabled.