You need to break up the regex and place the first part into the: SSHD_FORMAT_REGEX
and then the remainder into: USERDEF_FAILED_ENTRY_REGEX Something like this: SSHD_FORMAT_REGEX=.* (sshd.*:|\[sshd\]|vsftpd:) (?P<message>.*) USERDEF_FAILED_ENTRY_REGEX= authentication failure; .* ruser=(?P<user>.*?) .*rhost=(?P<host>.*) Regards, Phil On Fri, 28 Dec 2007, Bart Simpson wrote: > Hello, > I have try to set this to add vsftp: > USERDEF_FAILED_ENTRY_REGEX=.*vsftpd.* authentication failure.* > But denyhost will not act in case of wrong logins.:( > example of the vsftpd log in secure.log > Dec 28 15:50:01 xxxx44 vsftpd: pam_unix(vsftpd:auth): authentication > failure; logname= uid=0 euid=0 tty=ftp ruser=dgdgdg > rhost=p15181508.pureserver.info > > ------------------------------------------------------------------------- > This SF.net email is sponsored by: Microsoft > Defy all challenges. Microsoft(R) Visual Studio 2005. > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ > _______________________________________________ > Denyhosts-user mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/denyhosts-user > -- Regards, Phil Schwartz - http://www.phil-schwartz.com Open Source Projects: - DenyHosts: http://www.denyhosts.net - Kodos: http://kodos.sourceforge.net - ReleaseForge: http://releaseforge.sourceforge.net - Scratchy: http://scratchy.sourceforge.net - FAQtor: http://faqtor.sourceforge.net ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2005. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Denyhosts-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/denyhosts-user
