diff options
| -rw-r--r-- | bin/ncp/SECURITY/fail2ban.sh | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/bin/ncp/SECURITY/fail2ban.sh b/bin/ncp/SECURITY/fail2ban.sh index 5c8c6007..5aa65906 100644 --- a/bin/ncp/SECURITY/fail2ban.sh +++ b/bin/ncp/SECURITY/fail2ban.sh @@ -98,7 +98,9 @@ configure() before = common.conf [Definition] -failregex = Login failed.*Remote IP.*<HOST> +_groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*) +failregex = ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed: +datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?" ignoreregex = EOF |