Of course. You said it all – craft the filter and the external command and you
are all set. One of the beauties of this tool.
\\Greg
From: Hochreiter Martin<mailto:martin.hochrei...@fhstp.ac.at>
Sent: Thursday, April 13, 2017 5:11 AM
To:
fail2ban-users@lists.sourceforge.net<mailto:fail2ban-users@lists.sourceforge.net>
Subject: [Fail2ban-users] User user instead of ip
Hi!
Can I configure fail2ban to scan for usernames instead of ips?
What for?
Well, we scan for very high amounts of (successful) sasl user authentications
in a short time
(indication for misusage) and block the user on the active directory … but not
as good as fail2ban does this with ips
So, if I write a filter that filters for usernames and a custom action with an
external command – is this possible?
Regards
Martin
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Fail2ban-users mailing list
Fail2ban-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
