-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 04-06-15 17:13, Kamaldeep Singh wrote: > Hi > > On Thursday 04 June 2015 07:50 PM, Yves wrote: >> The "?" near the end of your RE seems to indicate that the whole >> contents of the parenthesis is optional. I wrote too fast and >> wrongly included actual parenthesis in my examples above, but the >> meaning remains: I'm not sure the end of the line really is >> optional. >> >> Were I you, I'd try this: ^.* sogod \[\d+\]: SOGoRootPage Login >> from '<HOST>' for user '[^']*' might not have worked.*$ >> >> I realize that "^.*" at the start, and ".*$" at the end, are a >> bit silly regarding pattern-matching, but some tools do need to >> perform full-string matching, and I don't know where fail2ban >> stands in this regard. > I tired your regex. No Luck >
This works for me with the supplied example: failregex = ^ sogod \[\d+\]: SOGoRootPage Login from '<HOST>' for user '.*' might not have worked - password policy: -?\d+ grace: -?\d+ expire: -?\d+ bound: -?\d+$ If you also need a variant without the password policy note appended, add a second failregex in stead of improving (i.e. complicating) the first one. @yves: the anchoring at start and finish is done in f2b to circumvent DOS attacks (see list archives for details) but when you change it into ^.* .... .*$, the protection doesn't work anymore. Technically f2b doesn't care if you anchor or not. Tom -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJVcVHGAAoJEJPfMZ19VO/1ZZsP/08HuWb5Lea9m9n9K/1KnXn2 kR5nLTDhFwfe1nokdAnvbZFsTwRCxU6xomwY7CzwsimFejDWLEBDAEOpdjHQ9Fe8 xufJBL/sjUqZaCwlhQ+7CguGC0DLKhDPkzHUvt1+pMLOXPm1RPuAKtplYKL2bEN9 81EHO1vpfPW/b86+IoXVva0zcTVEutWUfLcu5HYjgixPSERShOAm4HwCo9vGB+eb UvKUqSU0QPvvLM5YpnOKJrd6HVqIX+/kj/yU91QU4gyc48CuwN+oJXQxFMkEgjIr rZQUgkAFO0FNKJxG9xDL2Y2NgPJymHWuZAEp6AHmPKVB4U7ar8f1g4Mg3FWkmyCH cAQRaEQQF0CNL5E8ZMqwPRCCa1AgponJWFhbXaL6n664uIBLqOgFaHFW6upZ4XIC vpQ5iA0peyjh5z0lmxEddQNZXyN5cAM/3jRpWNB6DkWCSGBIhyq+n6smSgdHiQd3 A0g372fTjjl/xdHgAPTz5zTdve+06/7KHA3nyP8gtPR/xSYOcvH1jcrGCSxW9fNG Y/h6R7+qb4nK+nkypcHTva//Z7VkWlVKp9SjnDmq8ASs9W7ubw3QJCaw5pjbVJwE JYLgwJDvJHxP0CwJ7ZaqsACoOVRDpP+eSTvwcTL0namqASSzDPVkVNNsMTGP8ePM crkyryKjlWimsafhL/Uy =kLrT -----END PGP SIGNATURE----- ------------------------------------------------------------------------------ _______________________________________________ Fail2ban-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/fail2ban-users
