fail2ban(-regex) not recognizing proftpd logs

lartis · May 18, 2009

hi all,

i have a redhat el5 vserver and got fail2ban working for ssh without any problems. i wanted to add support for proftpd today.

the fail2ban-regex test tool doesnt find any matches for the following proftpd.conf:

# Fail2Ban configuration file
#
# Author: Yaroslav Halchenko
#
# $Revision: 677 $
#

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}?(?P<host>\S+)
# Values: TEXT
#
failregex = $\S+\[<HOST>\]$[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+$
$\S+\[<HOST>\]$[: -]+ USER \S+ $Login failed$: Incorrect password\.$
$\S+\[<HOST>\]$[: -]+ SECURITY VIOLATION: \S+ login attempted\.$
$\S+\[<HOST>\]$[: -]+ Maximum login attempts $\d+$ exceeded$

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
Click to expand...

log from /var/log/secure with failed logins looks like this:

May 18 01:17:38 mymachinehostname proftpd[24440]: my.hostname.com (12.345.67.89[12.345.67.89]) - USER testingfail2ban: no such user found from 12.345.67.89[12.345.67.89] to 11.222.333.44:21
Click to expand...

"fail2ban-regex /var/log/secure /etc/fail2ban/filter.d/proftpd.conf" gives me:

Running tests
=============

Use regex file : /etc/fail2ban/filter.d/proftpd.conf
Use log file : /var/log/secure

Results
=======

Failregex
|- Regular expressions:
| [1] \w+<HOST>[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+$
| [2] \w+<HOST>[: -]+ USER \S+ $Login failed$: Incorrect password\.$
| [3] \w+<HOST>[: -]+ SECURITY VIOLATION: \S+ login attempted\.$
| [4] \w+<HOST>[: -]+ Maximum login attempts $\d+$ exceeded$
|
`- Number of matches:
[1] 0 match(es)
[2] 0 match(es)
[3] 0 match(es)
[4] 0 match(es)

Ignoreregex
|- Regular expressions:
|
`- Number of matches:

Summary
=======

Sorry, no match
Click to expand...

any hints would be greatly appreciated,
thx guys

falko · May 18, 2009

What's in /etc/fail2ban/jail.local?

lartis · May 18, 2009

hey thanks for your answer,
i dont have a jail.local, for now i edited all the confs themselves

lartis · May 19, 2009

quick update maybe i can help someone:

i just wrote my own proftpd.conf with my poor regex skills but now theyre recognized properly, maybe too dirty for bigger / more complicated systems

failregex = ^(.)+proftpd(.)+\[<HOST>\](.)*no such user found from (.)* to (.)*$
^(.)+proftpd(.)+\[<HOST>\](.)*USER(.)*Login failed(.)*Incorrect password(.)*$
^(.)+proftpd(.)+\[<HOST>\](.)*SECURITY VIOLATION.)*login attempted(.)*$
^(.)+proftpd(.)+\[<HOST>\](.)*Maximum login attempts(.)*exceeded(.)*$
Click to expand...

Log in or Sign up

fail2ban(-regex) not recognizing proftpd logs

lartis New Member

falko Super Moderator Howtoforge Staff

lartis New Member

lartis New Member

Share This Page

Log in or Sign up

fail2ban(-regex) not recognizing proftpd logs

lartis New Member

falko Super Moderator Howtoforge Staff

lartis New Member

lartis New Member

Share This Page

Useful Searches