Hi Harry,
thanks again for your reply. I did some further testings and have found
the culprit here:
Its the date/time which fail2ban probably can't handle. ownCloud is
logging in form of:
{"reqId":"824ff389f8cbbe1a38a56df1bf08e0d7","remoteAddr":"192.168.0.1","app":"core","message":"Login
failed: 'abc' (Remote IP: '192.168.0.1', X-Forwarded-For:
'')","level":2,"time":"2015-05-25T13:13:00+00:00"}
which gets detected by fail2ban-regex as ISO 8601 and no ban is done (No
"Ban/Unban" logging in fail2ban.log).
However when i'm manually pasting the entries in my owncloud.log like:
{"reqId":"824ff389f8cbbe1a38a56df1bf08e0d7","remoteAddr":"192.168.0.1","app":"core","message":"Login
failed: 'abc' (Remote IP: '192.168.0.1', X-Forwarded-For:
'')","level":2,"time":"May 25 15:13:00"}
which used the same time format like dovecot (MONTH Day
Hour:Minute:Second detected by fail2ban-regex) the ban are correctly
done ("Ban/Unban" logging in fail2ban.log).
Are there any known issues with the ISO 8601 time format in version
0.8.13 shipped by Debian Jessie? Have checked the Changelog on github
but havn't found any pointers in this direction.
--
Chris
------------------------------------------------------------------------------
One dashboard for servers and applications across Physical-Virtual-Cloud
Widest out-of-the-box monitoring support with 50+ applications
Performance metrics, stats and reports that give you Actionable Insights
Deep dive visibility with transaction tracing using APM Insight.
http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
_______________________________________________
Fail2ban-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
