Howdy Chris, Glad I could somewhat help you out.
On Wed, 2015-05-27 at 08:46 +0200, Chris wrote: > Hi Lee, > > also thanks to you for your reply and sorry for the late reply. > > After doing some more tests it seems the timestamp format isn't the problem > but the timezone. > ownCloud itself is logging in UTC as a default and my server is in CEST so > fail2ban hasn't processed the failed logins because of the time difference of > 2 hours. > > So as a reference for further readers stumbling over the same problem with > ownCloud: > > The config of the posted pastebin: > > http://pastebin.com/q1EuMgYg > > as well as a: > > 'logtimezone' => 'Europe/Berlin', > > in the config/config.php of ownCloud works here now without any problems. > > Regards, > Chris > > > Gesendet: Montag, 25. Mai 2015 um 23:12 Uhr > > Von: "Lee Clemens" <[email protected]> > > An: Chris <[email protected]>, [email protected] > > Betreff: Re: [Fail2ban-users] Issues while trying to block failed login on > > ownCloud with fail2ban > > > > On 05/23/2015 08:29 PM, Chris wrote: > > > Hi list, > > > > > > i'm currently running fail2ban 0.8.13-1 on Debian Jessie and trying to > > > use it to ban failed logins on ownCloud 8.0.3. The following pastebin > > > contains all done configurations as well as the successful output of > > > fail2ban-regex and a log sample from a failed ownCloud login: > > > > > > http://pastebin.com/q1EuMgYg > > > > Can you also provide fail2ban-client status, fail2ban-client status <JAIL> > > and fail2ban-client -d > > ? > > > > If fail2ban-regex catches the log lines and they are within `findtime`, > > fail2ban should both behave the same. > > > > > > > > Unfortunately it seems that fail2ban-server is not detecting the failed > > > logins from the owncloud.log when logging into the GUI with wrong > > > credentials (maxretry is currently set to 3 as a default). > > > > > > There are other fail2ban jails like dovecot or ssh banning failed logins > > > without any problems. The main difference between those jails and the > > > ownCloud one are the different time/date detected by fail2ban-regex: > > > > > > dovecot: > > > [14821] MONTH Day Hour:Minute:Second > > > > > > owncloud: > > > [725] ISO 8601 > > > > As reported by fail2ban-regex, the ISO 8601 format is supported and > > identified properly. > > > > > > > > I'm currently completely stuck how to debug this further to see why > > > fail2ban-regex is successfully where fail2ban-server is failing. > > > > > > Thanks in advance for a reply / hints. > > > > > > > ------------------------------------------------------------------------------ > _______________________________________________ > Fail2ban-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/fail2ban-users
------------------------------------------------------------------------------
_______________________________________________ Fail2ban-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/fail2ban-users
