I remember I had this problem with PHPMyADMIN. I updated to the latest version and it started generating logs differently.
Before, the logs looked like this: Feb 15 17:10:55 www phpMyAdmin [3982]: user denied: root (mysql-denied) from 168.194.165.40 After I updated, the logs started to look like this: [15-Feb-2020 17:39:45 UTC] user denied: root (mysql-denied) from 168.194.165.40 After that, fail2ban worked as it should. I believe it must be the same case. I'm just not sure how to solve it. ---- Ativado Seg, 17 fev 2020 14:50:42 -0300 Henrique Fagundes <[email protected]> escreveu ---- > Dear, > > I also understand that it should be working. > I created a video to demonstrate the problem. > > Please see it: > https://www.youtube.com/watch?v=93e96B36PpA > > What else can I do to resolve this issue? > > ---- Ativado Seg, 17 fev 2020 14:32:24 -0300 Dudi Goldenberg > <[email protected]> escreveu ---- > > Hi Henrique, > > > > The failregex is Ok and fail2ban-regex matches the first 3 lines of your > log, so it should ban. > > > > Take a look at fail2ban.log, see if it find the attempts. > > > > Regards, > > > > Dudi > > > > -----Original Message----- > > From: Henrique Fagundes [mailto:[email protected]] > > Sent: Monday, February 17, 2020 18:53 > > To: Dudi Goldenberg <[email protected]> > > Cc: Fail2ban Users <[email protected]> > > Subject: RE: [Fail2ban-users] Blocking Logins in Drupal 7 does not work! > > > > Dear Dudi, > > > > Excuse me! > > > > Here is the right file: > > > https://temporario.aprendendolinux.com/fail2ban/filter.d/drupal-auth.conf.txt > > > > > > ---- Ativado Seg, 17 fev 2020 13:13:10 -0300 Dudi Goldenberg > <[email protected]> escreveu ---- > Hi, > > What is the content of > drupal-auth.conf? You pasted drupal-comment.conf. > > > > > > Regards, > > > > > > D. > > > > > > -----Original Message----- > > > From: Henrique Fagundes [mailto:[email protected]] > > > Sent: Monday, February 17, 2020 17:41 > To: Fail2ban Users > <[email protected]> > > > Subject: [Fail2ban-users] Blocking Logins in Drupal 7 does not work! > > > > > > ​Dear Colleagues, > > > > > > Good afternoon! > > > > > > But once, I come to enlist the help of this group. Some will certainly > remember me, with the PhpMyAdmin problem that I ended up solving with the > update. > > > > > > Now, I have the same problem with Drupal (and I cannot update it). I > can't get fail2ban to stop login attempts with error. > > > > > > What I find strange is that before migrating from server, it used > version 0.9.6-2 of fail2ban in Debian 9.12 and it worked correctly. > > > > > > I migrated the server to a CentOS 8.1 running fail2ban in version > 0.10.5-2. And after that, the lock does not work. > > > > > > I will share the configuration files with you: > > > > > > /etc/fail2ban/jail.conf: > > > https://temporario.aprendendolinux.com/fail2ban/jail.conf.txt > > > > > > /etc/fail2ban/filter.d/drupal-auth.conf: > > > > https://temporario.aprendendolinux.com/fail2ban/filter.d/drupal-comment.conf.txt > > > > > > /var/log/messages: > > > https://temporario.aprendendolinux.com/messages.txt > > > > > > I understand that the correct thing would be for fail2ban to block IP > 177.124.244.10 after the third login attempt, but it is not happening. > > > > > > can anybody help me? > > > > > > I apologize for the possible typos. I am Brazilian and I have > difficulties with English. > > > > > > > > > _______________________________________________ > > > Fail2ban-users mailing list > > > [email protected] > > > https://lists.sourceforge.net/lists/listinfo/fail2ban-users > > > > > > > > _______________________________________________ > Fail2ban-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/fail2ban-users > _______________________________________________ Fail2ban-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/fail2ban-users
