Skip to content
This repository has been archived by the owner on Sep 20, 2023. It is now read-only.

Fix failregex for fail2ban config #712

Merged
merged 2 commits into from
Oct 3, 2022
Merged

Fix failregex for fail2ban config #712

merged 2 commits into from
Oct 3, 2022

Conversation

Tobi823
Copy link
Contributor

@Tobi823 Tobi823 commented Oct 3, 2022

The user name is no longer surrounded by "

It seems that the log format for failed login attempts has changed. For example:

Oct 03 17:41:05 manjaro-server docker_jellyfin[461]: [16:41:05] [INF] [79] Jellyfin.Server.Implementations.Users.UserManager: Authentication request for arsasrtarstartarstars has been denied (IP: 172.16.53.2).

The user name is no longer surrounded by a quotation marks.

The user name is no longer surrounded by "
The IP of the failed authentication is also not surrounded by quotation marks
@Tobi823
Copy link
Contributor Author

Tobi823 commented Oct 3, 2022

My changes seem to work

fail2ban-regex -m SYSLOG_IDENTIFIER=docker_jellyfin systemd-journal /etc/fail2ban/filter.d/jellyfin.conf

Running tests
=============

Use   failregex filter file : jellyfin, basedir: /etc/fail2ban
Use         systemd journal
Use         encoding : UTF-8
Use    journal match : SYSLOG_IDENTIFIER=docker_jellyfin


Results
=======

Failregex: 32 total
|-  #) [# of hits] regular expression
|   1) [32] ^.*Authentication request for .* has been denied \(IP: <ADDR>\)\.
`-

Ignoreregex: 0 total

Lines: 26392 lines, 0 ignored, 32 matched, 26360 missed
[processed in 2.46 sec]

Missed line(s): too many to print.  Use --print-all-missed to print all 26360 lines

This pull request was closed.
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants