Fail2ban filter issue

Discussion in 'Installation/Configuration' started by jackyie.note, May 21, 2013.

  1. jackyie.note

    jackyie.note New Member

    to All:
    fail2ban install centos5.9. I am looking to create a conf file for fail2ban that contains the proper regex expression that bans repeat offenders that show up in the maillogs. The maillogs show the following:
    [2013/01/10 05:25:14] [36.224.203.36:27304] User sl.wang login failed.
    [2013/01/10 05:45:17] [36.224.203.36:30613] User sl.wang login failed.
    [2013/01/10 06:34:54] [36.224.203.36:7021] User sl.wang login failed.
    [2013/01/10 07:24:59] [36.224.203.36:15711] User sl.wang login failed.
    [2013/01/10 07:45:02] [36.224.203.36:19712] User sl.wang login failed.
    [2013/01/10 07:55:03] [36.224.203.36:21755] User sl.wang login failed.

    And I tried the following but to no avail:
    failregex = ^\[\d{1,4}\/d{1,2}\/d{1,2}.\d{1,2}:\d{1,2}:\d{1,2}\] \[<HOST>:.*].User.*.login failed

    Any ideas?
     

Share This Page