From d5dfda8905bbb668f769493233ca5a5fcb1827ba Mon Sep 17 00:00:00 2001 From: jes Date: Sun, 16 Dec 2018 22:30:25 +0800 Subject: [PATCH] updated fail2ban setup to match changes in logformat for 1.5.0 --- README.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 8b0d007a..22246ed2 100644 --- a/README.md +++ b/README.md @@ -441,7 +441,7 @@ If you are using docker-compose, add this to you yaml file: ``` With the above settings in the docker-compose file. Any failed login attempts will look like this in your syslog file: ``` -$DATE $TIME $SERVER $TAG[979]: ERROR: Username or password is incorrect. Try again. IP: XX.XX.XX.XX. Username: email@domain.com. +MMM DD hh:mm:ss server-hostname $TAG[773]: [YYYY-MM-DD][hh:mm:ss][bitwarden_rs::api::identity][ERROR] Username or password is incorrect. Try again. IP: XXX.XXX.XXX.XXX. Username: email@domain.com. ``` You can change the '$TAG' to anything you like. Just remember it because it will be in the Fail2Ban filter. @@ -457,7 +457,8 @@ And add the following before = common.conf [Definition] -failregex = ^%(__prefix_line)s.*$TAG.* ERROR: Username or password is incorrect. Try again. IP: \. Username:.*$ +_daemon = $TAG +failregex = ^%(__prefix_line)s.*Username or password is incorrect\. Try again\. IP: \. Username:.*$ ignoreregex = ``` Dont forget to change the '$TAG' to what you set it as from above.