Is there a way to make use of regex tags like mac and interface in the filter?
my_test.conf:
failregex =
DHCPREQUEST\s+for\s+<HOST>\s+from\s+(?P<mac>([0-9a-fA-F]{1,2}:){5}[0-9a-fA-F]{1,2}).+via\s+(?P<interface>.+)
DHCPACK to <HOST>
\((?P<mac>([0-9a-fA-F]{1,2}:){5}[0-9a-fA-F]{1,2})\).+via\s+(?P<interface>.+)
jail.local:
[my_test]
enabled = true
filter = my_test
action = my_ipset_ip[name=TestIp, bantime=3600]
logpath = /var/log/messages
maxretry = 0
bantime = 3600
my_ipset_ip.conf:
[Definition]
actioncheck =
actionstart =
actionstop =
actionban = ipset add fail2ban-<name> <mac> timeout <bantime> -exist
Thanks,
Bill
------------------------------------------------------------------------------
New Year. New Location. New Benefits. New Data Center in Ashburn, VA.
GigeNET is offering a free month of service with a new server in Ashburn.
Choose from 2 high performing configs, both with 100TB of bandwidth.
Higher redundancy.Lower latency.Increased capacity.Completely compliant.
vanity: www.gigenet.com
_______________________________________________
Fail2ban-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
