Hi Lee, also thanks to you for your reply and sorry for the late reply.
After doing some more tests it seems the timestamp format isn't the problem but the timezone. ownCloud itself is logging in UTC as a default and my server is in CEST so fail2ban hasn't processed the failed logins because of the time difference of 2 hours. So as a reference for further readers stumbling over the same problem with ownCloud: The config of the posted pastebin: http://pastebin.com/q1EuMgYg as well as a: 'logtimezone' => 'Europe/Berlin', in the config/config.php of ownCloud works here now without any problems. Regards, Chris > Gesendet: Montag, 25. Mai 2015 um 23:12 Uhr > Von: "Lee Clemens" <[email protected]> > An: Chris <[email protected]>, [email protected] > Betreff: Re: [Fail2ban-users] Issues while trying to block failed login on > ownCloud with fail2ban > > On 05/23/2015 08:29 PM, Chris wrote: > > Hi list, > > > > i'm currently running fail2ban 0.8.13-1 on Debian Jessie and trying to > > use it to ban failed logins on ownCloud 8.0.3. The following pastebin > > contains all done configurations as well as the successful output of > > fail2ban-regex and a log sample from a failed ownCloud login: > > > > http://pastebin.com/q1EuMgYg > > Can you also provide fail2ban-client status, fail2ban-client status <JAIL> > and fail2ban-client -d > ? > > If fail2ban-regex catches the log lines and they are within `findtime`, > fail2ban should both behave the same. > > > > > Unfortunately it seems that fail2ban-server is not detecting the failed > > logins from the owncloud.log when logging into the GUI with wrong > > credentials (maxretry is currently set to 3 as a default). > > > > There are other fail2ban jails like dovecot or ssh banning failed logins > > without any problems. The main difference between those jails and the > > ownCloud one are the different time/date detected by fail2ban-regex: > > > > dovecot: > > [14821] MONTH Day Hour:Minute:Second > > > > owncloud: > > [725] ISO 8601 > > As reported by fail2ban-regex, the ISO 8601 format is supported and > identified properly. > > > > > I'm currently completely stuck how to debug this further to see why > > fail2ban-regex is successfully where fail2ban-server is failing. > > > > Thanks in advance for a reply / hints. > > > ------------------------------------------------------------------------------ _______________________________________________ Fail2ban-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/fail2ban-users
