Commit 28b2bf28 authored by Vitaly Lipatov's avatar Vitaly Lipatov

add vsftpd filter to fail2ban

parent 5bd6cbf7
# Fail2Ban configuration file
#
# Author: Cyril Jaquier
#
# $Revision$
#
[Definition]
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values: TEXT
#
failregex = vsftpd(?:\(pam_unix\))?(?:\[\d+\])?:.* authentication failure; .* rhost=<HOST>(?:\s+user=\S*)?\s*$
\[.+\] FAIL LOGIN: Client "<HOST>"\s*$
FTP response: Client "<HOST>", "530
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
Wed Oct 9 12:14:45 2013 [pid 16470] [ftpkoochy] FAIL LOGIN: Client "95.32.141.118" Wed Oct 9 12:14:45 2013 [pid 16470] [ftpkoochy] FAIL LOGIN: Client "95.32.141.118"
Fri Dec 20 14:00:29 2013 [pid 25595] [changeme] FTP response: Client "190.81.24.243", "530 Permission denied."
Fri Dec 20 13:27:17 2013 [pid 29637] [azbyka] FTP response: Client "190.81.24.243", "530 Login incorrect."
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment