You can subscribe to this list here.
2005 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
(11) |
Oct
(8) |
Nov
(10) |
Dec
(8) |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2006 |
Jan
(6) |
Feb
(1) |
Mar
(43) |
Apr
(17) |
May
(2) |
Jun
(8) |
Jul
(9) |
Aug
(14) |
Sep
(15) |
Oct
(25) |
Nov
(20) |
Dec
(12) |
2007 |
Jan
(29) |
Feb
(19) |
Mar
(8) |
Apr
(12) |
May
(10) |
Jun
(9) |
Jul
(40) |
Aug
(33) |
Sep
(74) |
Oct
(19) |
Nov
(31) |
Dec
(13) |
2008 |
Jan
(50) |
Feb
(52) |
Mar
(43) |
Apr
(21) |
May
(68) |
Jun
(28) |
Jul
(6) |
Aug
(25) |
Sep
(14) |
Oct
(32) |
Nov
(7) |
Dec
(13) |
2009 |
Jan
(25) |
Feb
(1) |
Mar
(2) |
Apr
(8) |
May
(4) |
Jun
(6) |
Jul
(24) |
Aug
(40) |
Sep
(24) |
Oct
(15) |
Nov
(31) |
Dec
(35) |
2010 |
Jan
(6) |
Feb
(1) |
Mar
(23) |
Apr
(16) |
May
(4) |
Jun
(36) |
Jul
(20) |
Aug
(13) |
Sep
(36) |
Oct
(12) |
Nov
(9) |
Dec
(2) |
2011 |
Jan
(16) |
Feb
(9) |
Mar
(21) |
Apr
(33) |
May
(27) |
Jun
(31) |
Jul
(20) |
Aug
(7) |
Sep
(20) |
Oct
(41) |
Nov
(29) |
Dec
(52) |
2012 |
Jan
(127) |
Feb
(36) |
Mar
(15) |
Apr
(40) |
May
(23) |
Jun
(43) |
Jul
(84) |
Aug
(50) |
Sep
(31) |
Oct
(45) |
Nov
(43) |
Dec
(47) |
2013 |
Jan
(39) |
Feb
(83) |
Mar
(50) |
Apr
(50) |
May
(79) |
Jun
(87) |
Jul
(71) |
Aug
(41) |
Sep
(39) |
Oct
(81) |
Nov
(61) |
Dec
(74) |
2014 |
Jan
(76) |
Feb
(50) |
Mar
(45) |
Apr
(62) |
May
(59) |
Jun
(21) |
Jul
(93) |
Aug
(64) |
Sep
(53) |
Oct
(44) |
Nov
(37) |
Dec
(43) |
2015 |
Jan
(60) |
Feb
(72) |
Mar
(35) |
Apr
(50) |
May
(52) |
Jun
(89) |
Jul
(110) |
Aug
(94) |
Sep
(77) |
Oct
(82) |
Nov
(41) |
Dec
(26) |
2016 |
Jan
(42) |
Feb
(44) |
Mar
(26) |
Apr
(55) |
May
(26) |
Jun
(17) |
Jul
(63) |
Aug
(38) |
Sep
(43) |
Oct
(50) |
Nov
(45) |
Dec
(55) |
2017 |
Jan
(26) |
Feb
(29) |
Mar
(28) |
Apr
(40) |
May
(2) |
Jun
(16) |
Jul
(22) |
Aug
(21) |
Sep
(35) |
Oct
(47) |
Nov
(10) |
Dec
(15) |
2018 |
Jan
(18) |
Feb
(35) |
Mar
(71) |
Apr
(9) |
May
(39) |
Jun
(19) |
Jul
(14) |
Aug
(108) |
Sep
(5) |
Oct
(34) |
Nov
(24) |
Dec
(13) |
2019 |
Jan
(13) |
Feb
(19) |
Mar
(33) |
Apr
(11) |
May
(21) |
Jun
(61) |
Jul
(21) |
Aug
(80) |
Sep
(26) |
Oct
(10) |
Nov
(8) |
Dec
(4) |
2020 |
Jan
(26) |
Feb
(81) |
Mar
(31) |
Apr
(37) |
May
(52) |
Jun
(10) |
Jul
(47) |
Aug
(25) |
Sep
(63) |
Oct
(36) |
Nov
(19) |
Dec
(18) |
2021 |
Jan
(49) |
Feb
(11) |
Mar
(18) |
Apr
(21) |
May
(66) |
Jun
(8) |
Jul
(35) |
Aug
(30) |
Sep
(10) |
Oct
(31) |
Nov
(4) |
Dec
(23) |
2022 |
Jan
(1) |
Feb
(16) |
Mar
(34) |
Apr
(6) |
May
(2) |
Jun
|
Jul
(1) |
Aug
(17) |
Sep
(1) |
Oct
(2) |
Nov
(4) |
Dec
(16) |
2023 |
Jan
(10) |
Feb
(39) |
Mar
(7) |
Apr
(44) |
May
(17) |
Jun
(20) |
Jul
|
Aug
(2) |
Sep
(10) |
Oct
(7) |
Nov
(3) |
Dec
(3) |
2024 |
Jan
(1) |
Feb
(10) |
Mar
(8) |
Apr
(1) |
May
(19) |
Jun
(15) |
Jul
(3) |
Aug
(5) |
Sep
|
Oct
|
Nov
|
Dec
|
From: Alex <mys...@gm...> - 2024-05-31 00:38:24
|
Hi, I'd like to add the following pattern to the postfix filter. May 30 19:01:42 xavier postfix-116/postscreen[245785]: NOQUEUE: reject: RCPT from [173.248.144.200]:57963: 550 5.5.1 Protocol error; from=< web...@my...>, to=<jo...@ex...>, proto=SMTP, helo=< rdnsb18.mytrueguide.com> I have a basic understanding of how the postfix.conf filter works. If I'm correct, I need to modify the mdpr-normal pattern. However, I'm not sure I understand the difference between mdpr-normal and mdre-normal? mdpr-normal = (?:\w+: (?:milter-)?reject:|(?:improper command pipelining|too many errors) after \S+) mdre-normal=^%(_pref)s from [^[]*\[<HOST>\]%(_port)s: [45][50][04] [45]\.\d\.\d+ (?:(?:<[^>]*>)?: )?(?:(?:Helo command|(?:Sender|Recipient) address) rejected: )?(?:Service unavailable|(?:Client host|Command|Data command) rejected|Relay access denied|(?:Host|Domain) not found|need fully-qualified hostname|match%(exre-user)s)\b ^from [^[]*\[<HOST>\]%(_port)s:? Ideally, I'd like to not have to modify that regexp and be able to add my own, much like what appears to be happening with mdre-errors. Steps on where to go from here would be greatly appreciated. Thanks, Alex |
From: Arturo 'B. B. <bu...@bu...> - 2024-05-20 15:04:02
|
A tu servicio amigo. Enjoy fail2ban. You will succeed in learning it and stopping evil;) On Mon, May 20, 2024, 12:00 Maurizio Caloro <mau...@ca...> wrote: > > > Am 20.05.2024 um 16:42 schrieb Arturo 'Buanzo' Busleiman < > bu...@bu...>: > > > fail2ban-regex is what you need to use... trust me on this, I have a bit > of experience with fail2ban. > > > Thats not a problem, i trust you! > > Gracias por esta buena conversacion! > Saludos > M > > XD > > > > On Mon, May 20, 2024, 11:41 Maurizio Caloro <mau...@ca...> wrote: > >> >> >> Am 20.05.2024 um 16:30 schrieb Arturo 'Buanzo' Busleiman < >> bu...@bu...>: >> >> >> No, it might not be important, but considering the very focused problem >> you are trying to solve... specificity is required. >> >> >> That’s not a problem, that was only a try for a shorter solution >> „abbreviation“ but without impact. >> >> But with python i have the possibilities to sim this, or only with >> fail2ban-regex. >> >> I think that i have enough, like this mentoined paper and the folder >> „filter.d“ as example. >> >> Thanks >> >> >> On Mon, 20 May 2024 at 11:19, Maurizio Caloro via Fail2ban-users < >> fai...@li...> wrote: >> >>> Its mostly important that i understod the Syntax, so i found the >>> devlopment documentation from version 0.9. so here it’s a overview of the >>> right syntax. >>> >>> One syntax arn‘t important, the global perspective are the better road. >>> >>> Thanks >>> >>> Von meinem iPhone gesendet >>> >>> Am 20.05.2024 um 14:55 schrieb Nick Howitt via Fail2ban-users < >>> fai...@li...>: >>> >>> You also need to give us a bit more help, like examples of the failed >>> log you are trying to match. >>> >>> BTW, why try to match a port with \w+ and not \d+? And why \w+?. >>> >>> On 20/05/2024 13:36, Arturo 'Buanzo' Busleiman wrote: >>> >>> It would seem that you need to learn more regex before attempting to >>> write fail2ban custom filters. It is in fact a common syntax. You just need >>> to read about the particulars. >>> >>> Please use fail2ban-regex command to test and learn. >>> >>> Bye! >>> >>> On Mon, May 20, 2024, 09:28 Maurizio Caloro <mau...@ca...> wrote: >>> >>>> Yes, thanks, yes thats true >>>> >>>> - «.\[<HOST>\]:\ » >>>> >>>> but when i add this for example to pyrex, this didnt match. >>>> >>>> >>>> >>>> So its not possible to find any «regexeditor» that match with fail2ban >>>> so that i can simulate this? >>>> >>>> This also is a valid string, this match on « Regex101 python « but not >>>> with fail2ban >>>> >>>> - :\w+:\w+-\w+\w+\w+\w+\[<HOST>\]:\w+?w+?1.1 >>>> >>>> >>>> >>>> Sorry i have not yet understood which editor i can use for sim, or is >>>> fail2ban a separate unic regex Interpreter? >>>> >>>> Thanks for update >>>> >>>> >>>> >>>> *Von:* Nick Howitt via Fail2ban-users < >>>> fai...@li...> >>>> *Gesendet:* Montag, 20. Mai 2024 13:53 >>>> *An:* fai...@li... >>>> *Betreff:* Re: [Fail2ban-users] Fail2ban V1.1.0 from Github - question >>>> Regex >>>> >>>> >>>> >>>> Surely you need a <HOST> variable in that for f2b to work. Something >>>> like: >>>> >>>> NON-SMTP COMMAND from.\[<HOST>\]:\d+ after CONNECT:.GET./.HTTP/1.1 >>>> >>>> Normally you'd also expect some sort of timestamp in the logs. >>>> >>>> On 20/05/2024 12:37, Maurizio Caloro via Fail2ban-users wrote: >>>> >>>> Thanks for your answer >>>> >>>> >>>> >>>> Please, after generate this syntax, no chance to include this to >>>> Fail2ban. >>>> >>>> From 4389 found 0 hits >>>> >>>> >>>> >>>> [Appl PyRex] >>>> >>>> NON-SMTP COMMAND from.\[+.............\]:......after >>>> CONNECT:.GET./.HTTP/1.1 >>>> >>>> NON-SMTP COMMAND from [64.62.197.214]:13465 after CONNECT: GET / >>>> HTTP/1.1 >>>> >>>> >>>> >>>> But what are wrong here? >>>> >>>> thanks >>>> >>>> >>>> >>>> *Von:* Arturo 'Buanzo' Busleiman < bu...@bu... > >>>> <bu...@bu...> >>>> *Gesendet:* Montag, 20. Mai 2024 12:47 >>>> *An:* mau...@ca... >>>> *Cc:* Fail 2 Ban <Fai...@li...> >>>> <Fai...@li...> >>>> *Betreff:* Re: [Fail2ban-users] Fail2ban V1.1.0 from Github - question >>>> Regex >>>> >>>> >>>> >>>> Use pyrex or any python compatible one. Also be mindful of interpreting >>>> the filter definitions in filter.d and using fail2ban-regex as testing >>>> ground. >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> On Mon, May 20, 2024, 07:21 Maurizio Caloro via Fail2ban-users < >>>> fai...@li...> wrote: >>>> >>>> Hello >>>> >>>> Please i think the Version 1.1.0 are the newest Version from Fail2ban? >>>> >>>> >>>> >>>> Support this now full regex?, i see meny time, that i puzzle on >>>> regex101 me syntax and after implement >>>> >>>> This to live system, this will be always chane. >>>> >>>> >>>> >>>> So this question, about Regex compatilities ? >>>> >>>> Thanks >>>> >>>> _______________________________________________ >>>> Fail2ban-users mailing list >>>> Fai...@li... >>>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users >>>> >>>> >>>> >>>> >>>> _______________________________________________ >>>> >>>> Fail2ban-users mailing list >>>> >>>> Fai...@li... >>>> >>>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users >>>> >>>> >>>> >>> >>> _______________________________________________ >>> Fail2ban-users mailing list >>> Fai...@li... >>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users >>> >>> _______________________________________________ >>> Fail2ban-users mailing list >>> Fai...@li... >>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users >>> >> |
From: Maurizio C. <mau...@ca...> - 2024-05-20 14:59:46
|
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr"><br></div><div dir="ltr"><br><blockquote type="cite">Am 20.05.2024 um 16:42 schrieb Arturo 'Buanzo' Busleiman <bu...@bu...>:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><div dir="auto">fail2ban-regex is what you need to use... trust me on this, I have a bit of experience with fail2ban.<div dir="auto"><br></div></div></div></blockquote><div><br></div>Thats not a problem, i trust you!<div><br></div><div>Gracias por esta buena conversacion!<br><div>Saludos</div><div>M</div><div><br><blockquote type="cite"><div dir="ltr"><div dir="auto"><div dir="auto">XD</div><div dir="auto"><br></div><div dir="auto"><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, May 20, 2024, 11:41 Maurizio Caloro <<a href="mailto:mau...@ca...">mau...@ca...</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto"><div dir="ltr"><br></div><div dir="ltr"><br><blockquote type="cite">Am 20.05.2024 um 16:30 schrieb Arturo 'Buanzo' Busleiman <<a href="mailto:bu...@bu..." target="_blank" rel="noreferrer">bu...@bu...</a>>:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><div dir="ltr">No, it might not be important, but considering the very focused problem you are trying to solve... specificity is required.<div><br></div></div></div></blockquote><div><br></div>That’s not a problem, that was only a try for a shorter solution „abbreviation“ but without impact.<div><br></div><div>But with python i have the possibilities to sim this, or only with fail2ban-regex.<br><div><br></div><div>I think that i have enough, like this mentoined paper and the folder „filter.d“ as example.</div><div><br></div><div>Thanks</div><div><blockquote type="cite"><div dir="ltr"><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, 20 May 2024 at 11:19, Maurizio Caloro via Fail2ban-users <<a href="mailto:fai...@li..." target="_blank" rel="noreferrer">fai...@li...</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto"><div dir="ltr">Its mostly important that i understod the Syntax, so i found the devlopment documentation from version 0.9. so here it’s a overview of the right syntax.<div><br></div><div>One syntax arn‘t important, the global perspective are the better road.</div><div><br></div><div>Thanks</div><div><br id="m_-5702245819063257972m_-3142848838625252518lineBreakAtBeginningOfSignature"><div dir="ltr">Von meinem iPhone gesendet</div><div dir="ltr"><br><blockquote type="cite">Am 20.05.2024 um 14:55 schrieb Nick Howitt via Fail2ban-users <<a href="mailto:fai...@li..." target="_blank" rel="noreferrer">fai...@li...</a>>:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"> You also need to give us a bit more help, like examples of the failed log you are trying to match.<br> <br> BTW, why try to match a port with \w+ and not \d+? And why \w+?.<br> <br> <div>On 20/05/2024 13:36, Arturo 'Buanzo' Busleiman wrote:<br> </div> <blockquote type="cite"> <div dir="auto">It would seem that you need to learn more regex before attempting to write fail2ban custom filters. It is in fact a common syntax. You just need to read about the particulars. <div dir="auto"><br> </div> <div dir="auto">Please use fail2ban-regex command to test and learn.</div> <div dir="auto"><br> </div> <div dir="auto">Bye!</div> </div> <br> <div class="gmail_quote"> <div dir="ltr" class="gmail_attr">On Mon, May 20, 2024, 09:28 Maurizio Caloro <<a href="mailto:mau...@ca..." target="_blank" rel="noreferrer">mau...@ca...</a>> wrote:<br> </div> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <div lang="DE-CH"> <div> <p class="MsoNormal"><span style="font-size:11pt">Yes, thanks, yes thats true</span></p> <ul style="margin-top:0cm" type="disc"> <li style="margin-left:17.4pt"><span style="font-size:11pt">«.\[<HOST>\]:\ »</span></li> </ul> <p class="MsoNormal"><span style="font-size:11pt">but when i add this for example to pyrex, this didnt match.</span></p> <p class="MsoNormal"><span style="font-size:11pt"> </span></p> <p class="MsoNormal"><span style="font-size:11pt">So its not possible to find any «regexeditor» that match with fail2ban so that i can simulate this?</span></p> <p class="MsoNormal"><span style="font-size:11pt" lang="FR-CH">This also is a valid string, this match on « Regex101 python « but not with fail2ban</span></p> <ul style="margin-top:0cm" type="disc"> <li style="margin-left:17.4pt"><span style="font-size:11pt">:\w+:\w+-\w+\w+\w+\w+\[<HOST>\]:\w+?w+?1.1</span></li> </ul> <p class="MsoNormal"><span style="font-size:11pt"> </span></p> <p class="MsoNormal"><span style="font-size:11pt">Sorry i have not yet understood which editor i can use for sim, or is fail2ban a separate unic regex Interpreter?</span></p> <p class="MsoNormal"><span style="font-size:11pt">Thanks for update</span></p> <p class="MsoNormal"><span style="font-size:11pt"> </span></p> <div> <div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0cm 0cm"> <p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif" lang="DE">Von:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif" lang="DE"> Nick Howitt via Fail2ban-users <<a href="mailto:fai...@li..." rel="noreferrer noreferrer" target="_blank">fai...@li...</a>> <br> <b>Gesendet:</b> Montag, 20. Mai 2024 13:53<br> <b>An:</b> <a href="mailto:fai...@li..." rel="noreferrer noreferrer" target="_blank">fai...@li...</a><br> <b>Betreff:</b> Re: [Fail2ban-users] Fail2ban V1.1.0 from Github - question Regex</span></p> </div> </div> <p class="MsoNormal"> </p> <p class="MsoNormal" style="margin-bottom:12pt">Surely you need a <HOST> variable in that for f2b to work. Something like:<br> <br> <span lang="FR-CH">NON-SMTP COMMAND from.\[<HOST>\]:\d+ after CONNECT:.GET./.HTTP/1.1</span><br> <br> Normally you'd also expect some sort of timestamp in the logs.</p> <div> <p class="MsoNormal">On 20/05/2024 12:37, Maurizio Caloro via Fail2ban-users wrote:</p> </div> <blockquote style="margin-top:5pt;margin-bottom:5pt"> <p class="MsoNormal"><span style="font-size:11pt">Thanks for your answer</span></p> <p class="MsoNormal"><span style="font-size:11pt"> </span></p> <p class="MsoNormal"><span style="font-size:11pt">Please, after generate this syntax, no chance to include this to Fail2ban.</span></p> <p class="MsoNormal"><span style="font-size:11pt">From 4389 found 0 hits</span></p> <p class="MsoNormal"><span style="font-size:11pt"> </span></p> <p class="MsoNormal"><span style="font-size:11pt" lang="FR-CH">[Appl PyRex]</span></p> <p class="MsoNormal"><span lang="FR-CH">NON-SMTP COMMAND from.\[+.............\]:......after CONNECT:.GET./.HTTP/1.1</span></p> <p class="MsoNormal"><span style="color:black;background:rgb(198,227,255)" lang="FR-CH">NON-SMTP COMMAND from [64.62.197.214]:13465 after CONNECT: GET / HTTP/1.1</span></p> <p class="MsoNormal"><span style="color:black;background:rgb(198,227,255)" lang="FR-CH"> </span></p> <p class="MsoNormal"><span style="font-size:11pt">But what are wrong here?</span></p> <p class="MsoNormal"><span style="font-size:11pt">thanks</span></p> <p class="MsoNormal"><span style="font-size:11pt"> </span></p> <div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0cm 0cm"> <p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif" lang="DE">Von:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif" lang="DE"> Arturo 'Buanzo' Busleiman <a href="mailto:bu...@bu..." rel="noreferrer noreferrer" target="_blank"><<span style="font-size:12pt;font-family:Aptos,sans-serif;color:windowtext;text-decoration:none"> </span><span style="color:windowtext">bu...@bu...</span> ></a> <br> <b>Gesendet:</b> Montag, 20. Mai 2024 12:47<br> <b>An:</b> <a href="mailto:mau...@ca..." rel="noreferrer noreferrer" target="_blank">mau...@ca...</a><br> <b>Cc:</b> Fail 2 Ban <a href="mailto:Fai...@li..." rel="noreferrer noreferrer" target="_blank"><Fai...@li...></a><br> <b>Betreff:</b> Re: [Fail2ban-users] Fail2ban V1.1.0 from Github - question Regex</span></p> </div> <p class="MsoNormal"> </p> <div> <p class="MsoNormal">Use pyrex or any python compatible one. Also be mindful of interpreting the filter definitions in filter.d and using fail2ban-regex as testing ground.</p> <div> <p class="MsoNormal"> </p> </div> <div> <p class="MsoNormal"> </p> </div> </div> <p class="MsoNormal"> </p> <div> <div> <p class="MsoNormal">On Mon, May 20, 2024, 07:21 Maurizio Caloro via Fail2ban-users <<a href="mailto:fai...@li..." rel="noreferrer noreferrer" target="_blank">fai...@li...</a>> wrote:</p> </div> <blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt"> <div> <div> <p class="MsoNormal"><span lang="DE">Hello</span></p> <p class="MsoNormal">Please i think the Version 1.1.0 are the newest Version from Fail2ban?</p> <p class="MsoNormal"> </p> <p class="MsoNormal"><span lang="FR-CH">Support this now full regex?, i see meny time, that i puzzle on regex101 me syntax and after implement</span></p> <p class="MsoNormal">This to live system, this will be always chane.</p> <p class="MsoNormal"> </p> <p class="MsoNormal"><span lang="FR-CH">So this question, about Regex compatilities ?</span></p> <p class="MsoNormal"><span lang="FR-CH">Thanks</span></p> </div> </div> <p class="MsoNormal">_______________________________________________<br> Fail2ban-users mailing list<br> <a href="mailto:Fai...@li..." rel="noreferrer noreferrer" target="_blank">Fai...@li...</a><br> <a href="https://lists.sourceforge.net/lists/listinfo/fail2ban-users" rel="noreferrer noreferrer" target="_blank">https://lists.sourceforge.net/lists/listinfo/fail2ban-users</a></p> </blockquote> </div> <p class="MsoNormal"><br> <br> <br> </p> <pre>_______________________________________________</pre> <pre>Fail2ban-users mailing list</pre> <pre><a href="mailto:Fai...@li..." rel="noreferrer noreferrer" target="_blank">Fai...@li...</a></pre> <pre><a href="https://lists.sourceforge.net/lists/listinfo/fail2ban-users" rel="noreferrer noreferrer" target="_blank">https://lists.sourceforge.net/lists/listinfo/fail2ban-users</a></pre> </blockquote> <p class="MsoNormal"> </p> </div> </div> </blockquote> </div> </blockquote> <br> <u></u><u></u> <span>_______________________________________________</span><br><span>Fail2ban-users mailing list</span><br><span><a href="mailto:Fai...@li..." target="_blank" rel="noreferrer">Fai...@li...</a></span><br><span><a href="https://lists.sourceforge.net/lists/listinfo/fail2ban-users" target="_blank" rel="noreferrer">https://lists.sourceforge.net/lists/listinfo/fail2ban-users</a></span><br></div></blockquote></div></div></div>_______________________________________________<br> Fail2ban-users mailing list<br> <a href="mailto:Fai...@li..." target="_blank" rel="noreferrer">Fai...@li...</a><br> <a href="https://lists.sourceforge.net/lists/listinfo/fail2ban-users" rel="noreferrer noreferrer" target="_blank">https://lists.sourceforge.net/lists/listinfo/fail2ban-users</a><br> </blockquote></div> </div></blockquote></div></div></div></blockquote></div> </div></blockquote></div></div></body></html> |
From: Arturo 'B. B. <bu...@bu...> - 2024-05-20 14:42:52
|
fail2ban-regex is what you need to use... trust me on this, I have a bit of experience with fail2ban. XD On Mon, May 20, 2024, 11:41 Maurizio Caloro <mau...@ca...> wrote: > > > Am 20.05.2024 um 16:30 schrieb Arturo 'Buanzo' Busleiman < > bu...@bu...>: > > > No, it might not be important, but considering the very focused problem > you are trying to solve... specificity is required. > > > That’s not a problem, that was only a try for a shorter solution > „abbreviation“ but without impact. > > But with python i have the possibilities to sim this, or only with > fail2ban-regex. > > I think that i have enough, like this mentoined paper and the folder > „filter.d“ as example. > > Thanks > > > On Mon, 20 May 2024 at 11:19, Maurizio Caloro via Fail2ban-users < > fai...@li...> wrote: > >> Its mostly important that i understod the Syntax, so i found the >> devlopment documentation from version 0.9. so here it’s a overview of the >> right syntax. >> >> One syntax arn‘t important, the global perspective are the better road. >> >> Thanks >> >> Von meinem iPhone gesendet >> >> Am 20.05.2024 um 14:55 schrieb Nick Howitt via Fail2ban-users < >> fai...@li...>: >> >> You also need to give us a bit more help, like examples of the failed >> log you are trying to match. >> >> BTW, why try to match a port with \w+ and not \d+? And why \w+?. >> >> On 20/05/2024 13:36, Arturo 'Buanzo' Busleiman wrote: >> >> It would seem that you need to learn more regex before attempting to >> write fail2ban custom filters. It is in fact a common syntax. You just need >> to read about the particulars. >> >> Please use fail2ban-regex command to test and learn. >> >> Bye! >> >> On Mon, May 20, 2024, 09:28 Maurizio Caloro <mau...@ca...> wrote: >> >>> Yes, thanks, yes thats true >>> >>> - «.\[<HOST>\]:\ » >>> >>> but when i add this for example to pyrex, this didnt match. >>> >>> >>> >>> So its not possible to find any «regexeditor» that match with fail2ban >>> so that i can simulate this? >>> >>> This also is a valid string, this match on « Regex101 python « but not >>> with fail2ban >>> >>> - :\w+:\w+-\w+\w+\w+\w+\[<HOST>\]:\w+?w+?1.1 >>> >>> >>> >>> Sorry i have not yet understood which editor i can use for sim, or is >>> fail2ban a separate unic regex Interpreter? >>> >>> Thanks for update >>> >>> >>> >>> *Von:* Nick Howitt via Fail2ban-users < >>> fai...@li...> >>> *Gesendet:* Montag, 20. Mai 2024 13:53 >>> *An:* fai...@li... >>> *Betreff:* Re: [Fail2ban-users] Fail2ban V1.1.0 from Github - question >>> Regex >>> >>> >>> >>> Surely you need a <HOST> variable in that for f2b to work. Something >>> like: >>> >>> NON-SMTP COMMAND from.\[<HOST>\]:\d+ after CONNECT:.GET./.HTTP/1.1 >>> >>> Normally you'd also expect some sort of timestamp in the logs. >>> >>> On 20/05/2024 12:37, Maurizio Caloro via Fail2ban-users wrote: >>> >>> Thanks for your answer >>> >>> >>> >>> Please, after generate this syntax, no chance to include this to >>> Fail2ban. >>> >>> From 4389 found 0 hits >>> >>> >>> >>> [Appl PyRex] >>> >>> NON-SMTP COMMAND from.\[+.............\]:......after >>> CONNECT:.GET./.HTTP/1.1 >>> >>> NON-SMTP COMMAND from [64.62.197.214]:13465 after CONNECT: GET / HTTP/1.1 >>> >>> >>> >>> But what are wrong here? >>> >>> thanks >>> >>> >>> >>> *Von:* Arturo 'Buanzo' Busleiman < bu...@bu... > >>> <bu...@bu...> >>> *Gesendet:* Montag, 20. Mai 2024 12:47 >>> *An:* mau...@ca... >>> *Cc:* Fail 2 Ban <Fai...@li...> >>> <Fai...@li...> >>> *Betreff:* Re: [Fail2ban-users] Fail2ban V1.1.0 from Github - question >>> Regex >>> >>> >>> >>> Use pyrex or any python compatible one. Also be mindful of interpreting >>> the filter definitions in filter.d and using fail2ban-regex as testing >>> ground. >>> >>> >>> >>> >>> >>> >>> >>> On Mon, May 20, 2024, 07:21 Maurizio Caloro via Fail2ban-users < >>> fai...@li...> wrote: >>> >>> Hello >>> >>> Please i think the Version 1.1.0 are the newest Version from Fail2ban? >>> >>> >>> >>> Support this now full regex?, i see meny time, that i puzzle on regex101 >>> me syntax and after implement >>> >>> This to live system, this will be always chane. >>> >>> >>> >>> So this question, about Regex compatilities ? >>> >>> Thanks >>> >>> _______________________________________________ >>> Fail2ban-users mailing list >>> Fai...@li... >>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users >>> >>> >>> >>> >>> _______________________________________________ >>> >>> Fail2ban-users mailing list >>> >>> Fai...@li... >>> >>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users >>> >>> >>> >> >> _______________________________________________ >> Fail2ban-users mailing list >> Fai...@li... >> https://lists.sourceforge.net/lists/listinfo/fail2ban-users >> >> _______________________________________________ >> Fail2ban-users mailing list >> Fai...@li... >> https://lists.sourceforge.net/lists/listinfo/fail2ban-users >> > |
From: Maurizio C. <mau...@ca...> - 2024-05-20 14:40:56
|
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr"><br></div><div dir="ltr"><br><blockquote type="cite">Am 20.05.2024 um 16:30 schrieb Arturo 'Buanzo' Busleiman <bu...@bu...>:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><div dir="ltr">No, it might not be important, but considering the very focused problem you are trying to solve... specificity is required.<div><br></div></div></div></blockquote><div><br></div>That’s not a problem, that was only a try for a shorter solution „abbreviation“ but without impact.<div><br></div><div>But with python i have the possibilities to sim this, or only with fail2ban-regex.<br><div><br></div><div>I think that i have enough, like this mentoined paper and the folder „filter.d“ as example.</div><div><br></div><div>Thanks</div><div><blockquote type="cite"><div dir="ltr"><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, 20 May 2024 at 11:19, Maurizio Caloro via Fail2ban-users <<a href="mailto:fai...@li...">fai...@li...</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto"><div dir="ltr">Its mostly important that i understod the Syntax, so i found the devlopment documentation from version 0.9. so here it’s a overview of the right syntax.<div><br></div><div>One syntax arn‘t important, the global perspective are the better road.</div><div><br></div><div>Thanks</div><div><br id="m_-3142848838625252518lineBreakAtBeginningOfSignature"><div dir="ltr">Von meinem iPhone gesendet</div><div dir="ltr"><br><blockquote type="cite">Am 20.05.2024 um 14:55 schrieb Nick Howitt via Fail2ban-users <<a href="mailto:fai...@li..." target="_blank">fai...@li...</a>>:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"> You also need to give us a bit more help, like examples of the failed log you are trying to match.<br> <br> BTW, why try to match a port with \w+ and not \d+? And why \w+?.<br> <br> <div>On 20/05/2024 13:36, Arturo 'Buanzo' Busleiman wrote:<br> </div> <blockquote type="cite"> <div dir="auto">It would seem that you need to learn more regex before attempting to write fail2ban custom filters. It is in fact a common syntax. You just need to read about the particulars. <div dir="auto"><br> </div> <div dir="auto">Please use fail2ban-regex command to test and learn.</div> <div dir="auto"><br> </div> <div dir="auto">Bye!</div> </div> <br> <div class="gmail_quote"> <div dir="ltr" class="gmail_attr">On Mon, May 20, 2024, 09:28 Maurizio Caloro <<a href="mailto:mau...@ca..." target="_blank">mau...@ca...</a>> wrote:<br> </div> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <div style="overflow-wrap: break-word;" lang="DE-CH"> <div> <p class="MsoNormal"><span style="font-size:11pt">Yes, thanks, yes thats true</span></p> <ul style="margin-top:0cm" type="disc"> <li style="margin-left:17.4pt"><span style="font-size:11pt">«.\[<HOST>\]:\ »</span></li> </ul> <p class="MsoNormal"><span style="font-size:11pt">but when i add this for example to pyrex, this didnt match.</span></p> <p class="MsoNormal"><span style="font-size:11pt"> </span></p> <p class="MsoNormal"><span style="font-size:11pt">So its not possible to find any «regexeditor» that match with fail2ban so that i can simulate this?</span></p> <p class="MsoNormal"><span style="font-size:11pt" lang="FR-CH">This also is a valid string, this match on « Regex101 python « but not with fail2ban</span></p> <ul style="margin-top:0cm" type="disc"> <li style="margin-left:17.4pt"><span style="font-size:11pt">:\w+:\w+-\w+\w+\w+\w+\[<HOST>\]:\w+?w+?1.1</span></li> </ul> <p class="MsoNormal"><span style="font-size:11pt"> </span></p> <p class="MsoNormal"><span style="font-size:11pt">Sorry i have not yet understood which editor i can use for sim, or is fail2ban a separate unic regex Interpreter?</span></p> <p class="MsoNormal"><span style="font-size:11pt">Thanks for update</span></p> <p class="MsoNormal"><span style="font-size:11pt"> </span></p> <div> <div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0cm 0cm"> <p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif" lang="DE">Von:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif" lang="DE"> Nick Howitt via Fail2ban-users <<a href="mailto:fai...@li..." rel="noreferrer" target="_blank">fai...@li...</a>> <br> <b>Gesendet:</b> Montag, 20. Mai 2024 13:53<br> <b>An:</b> <a href="mailto:fai...@li..." rel="noreferrer" target="_blank">fai...@li...</a><br> <b>Betreff:</b> Re: [Fail2ban-users] Fail2ban V1.1.0 from Github - question Regex</span></p> </div> </div> <p class="MsoNormal"> </p> <p class="MsoNormal" style="margin-bottom:12pt">Surely you need a <HOST> variable in that for f2b to work. Something like:<br> <br> <span lang="FR-CH">NON-SMTP COMMAND from.\[<HOST>\]:\d+ after CONNECT:.GET./.HTTP/1.1</span><br> <br> Normally you'd also expect some sort of timestamp in the logs.</p> <div> <p class="MsoNormal">On 20/05/2024 12:37, Maurizio Caloro via Fail2ban-users wrote:</p> </div> <blockquote style="margin-top:5pt;margin-bottom:5pt"> <p class="MsoNormal"><span style="font-size:11pt">Thanks for your answer</span></p> <p class="MsoNormal"><span style="font-size:11pt"> </span></p> <p class="MsoNormal"><span style="font-size:11pt">Please, after generate this syntax, no chance to include this to Fail2ban.</span></p> <p class="MsoNormal"><span style="font-size:11pt">From 4389 found 0 hits</span></p> <p class="MsoNormal"><span style="font-size:11pt"> </span></p> <p class="MsoNormal"><span style="font-size:11pt" lang="FR-CH">[Appl PyRex]</span></p> <p class="MsoNormal"><span lang="FR-CH">NON-SMTP COMMAND from.\[+.............\]:......after CONNECT:.GET./.HTTP/1.1</span></p> <p class="MsoNormal"><span style="color:black;background:rgb(198,227,255)" lang="FR-CH">NON-SMTP COMMAND from [64.62.197.214]:13465 after CONNECT: GET / HTTP/1.1</span></p> <p class="MsoNormal"><span style="color:black;background:rgb(198,227,255)" lang="FR-CH"> </span></p> <p class="MsoNormal"><span style="font-size:11pt">But what are wrong here?</span></p> <p class="MsoNormal"><span style="font-size:11pt">thanks</span></p> <p class="MsoNormal"><span style="font-size:11pt"> </span></p> <div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0cm 0cm"> <p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif" lang="DE">Von:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif" lang="DE"> Arturo 'Buanzo' Busleiman <a href="mailto:bu...@bu..." rel="noreferrer" target="_blank"><<span style="font-size:12pt;font-family:Aptos,sans-serif;color:windowtext;text-decoration:none"> </span><span style="color:windowtext">bu...@bu...</span> ></a> <br> <b>Gesendet:</b> Montag, 20. Mai 2024 12:47<br> <b>An:</b> <a href="mailto:mau...@ca..." rel="noreferrer" target="_blank">mau...@ca...</a><br> <b>Cc:</b> Fail 2 Ban <a href="mailto:Fai...@li..." rel="noreferrer" target="_blank"><Fai...@li...></a><br> <b>Betreff:</b> Re: [Fail2ban-users] Fail2ban V1.1.0 from Github - question Regex</span></p> </div> <p class="MsoNormal"> </p> <div> <p class="MsoNormal">Use pyrex or any python compatible one. Also be mindful of interpreting the filter definitions in filter.d and using fail2ban-regex as testing ground.</p> <div> <p class="MsoNormal"> </p> </div> <div> <p class="MsoNormal"> </p> </div> </div> <p class="MsoNormal"> </p> <div> <div> <p class="MsoNormal">On Mon, May 20, 2024, 07:21 Maurizio Caloro via Fail2ban-users <<a href="mailto:fai...@li..." rel="noreferrer" target="_blank">fai...@li...</a>> wrote:</p> </div> <blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt"> <div> <div> <p class="MsoNormal"><span lang="DE">Hello</span></p> <p class="MsoNormal">Please i think the Version 1.1.0 are the newest Version from Fail2ban?</p> <p class="MsoNormal"> </p> <p class="MsoNormal"><span lang="FR-CH">Support this now full regex?, i see meny time, that i puzzle on regex101 me syntax and after implement</span></p> <p class="MsoNormal">This to live system, this will be always chane.</p> <p class="MsoNormal"> </p> <p class="MsoNormal"><span lang="FR-CH">So this question, about Regex compatilities ?</span></p> <p class="MsoNormal"><span lang="FR-CH">Thanks</span></p> </div> </div> <p class="MsoNormal">_______________________________________________<br> Fail2ban-users mailing list<br> <a href="mailto:Fai...@li..." rel="noreferrer" target="_blank">Fai...@li...</a><br> <a href="https://lists.sourceforge.net/lists/listinfo/fail2ban-users" rel="noreferrer" target="_blank">https://lists.sourceforge.net/lists/listinfo/fail2ban-users</a></p> </blockquote> </div> <p class="MsoNormal"><br> <br> <br> </p> <pre>_______________________________________________</pre> <pre>Fail2ban-users mailing list</pre> <pre><a href="mailto:Fai...@li..." rel="noreferrer" target="_blank">Fai...@li...</a></pre> <pre><a href="https://lists.sourceforge.net/lists/listinfo/fail2ban-users" rel="noreferrer" target="_blank">https://lists.sourceforge.net/lists/listinfo/fail2ban-users</a></pre> </blockquote> <p class="MsoNormal"> </p> </div> </div> </blockquote> </div> </blockquote> <br> <u></u><u></u> <span>_______________________________________________</span><br><span>Fail2ban-users mailing list</span><br><span><a href="mailto:Fai...@li..." target="_blank">Fai...@li...</a></span><br><span><a href="https://lists.sourceforge.net/lists/listinfo/fail2ban-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/fail2ban-users</a></span><br></div></blockquote></div></div></div>_______________________________________________<br> Fail2ban-users mailing list<br> <a href="mailto:Fai...@li..." target="_blank">Fai...@li...</a><br> <a href="https://lists.sourceforge.net/lists/listinfo/fail2ban-users" rel="noreferrer" target="_blank">https://lists.sourceforge.net/lists/listinfo/fail2ban-users</a><br> </blockquote></div> </div></blockquote></div></div></body></html> |
From: Arturo 'B. B. <bu...@bu...> - 2024-05-20 14:30:21
|
No, it might not be important, but considering the very focused problem you are trying to solve... specificity is required. On Mon, 20 May 2024 at 11:19, Maurizio Caloro via Fail2ban-users < fai...@li...> wrote: > Its mostly important that i understod the Syntax, so i found the > devlopment documentation from version 0.9. so here it’s a overview of the > right syntax. > > One syntax arn‘t important, the global perspective are the better road. > > Thanks > > Von meinem iPhone gesendet > > Am 20.05.2024 um 14:55 schrieb Nick Howitt via Fail2ban-users < > fai...@li...>: > > You also need to give us a bit more help, like examples of the failed > log you are trying to match. > > BTW, why try to match a port with \w+ and not \d+? And why \w+?. > > On 20/05/2024 13:36, Arturo 'Buanzo' Busleiman wrote: > > It would seem that you need to learn more regex before attempting to write > fail2ban custom filters. It is in fact a common syntax. You just need to > read about the particulars. > > Please use fail2ban-regex command to test and learn. > > Bye! > > On Mon, May 20, 2024, 09:28 Maurizio Caloro <mau...@ca...> wrote: > >> Yes, thanks, yes thats true >> >> - «.\[<HOST>\]:\ » >> >> but when i add this for example to pyrex, this didnt match. >> >> >> >> So its not possible to find any «regexeditor» that match with fail2ban so >> that i can simulate this? >> >> This also is a valid string, this match on « Regex101 python « but not >> with fail2ban >> >> - :\w+:\w+-\w+\w+\w+\w+\[<HOST>\]:\w+?w+?1.1 >> >> >> >> Sorry i have not yet understood which editor i can use for sim, or is >> fail2ban a separate unic regex Interpreter? >> >> Thanks for update >> >> >> >> *Von:* Nick Howitt via Fail2ban-users < >> fai...@li...> >> *Gesendet:* Montag, 20. Mai 2024 13:53 >> *An:* fai...@li... >> *Betreff:* Re: [Fail2ban-users] Fail2ban V1.1.0 from Github - question >> Regex >> >> >> >> Surely you need a <HOST> variable in that for f2b to work. Something like: >> >> NON-SMTP COMMAND from.\[<HOST>\]:\d+ after CONNECT:.GET./.HTTP/1.1 >> >> Normally you'd also expect some sort of timestamp in the logs. >> >> On 20/05/2024 12:37, Maurizio Caloro via Fail2ban-users wrote: >> >> Thanks for your answer >> >> >> >> Please, after generate this syntax, no chance to include this to Fail2ban. >> >> From 4389 found 0 hits >> >> >> >> [Appl PyRex] >> >> NON-SMTP COMMAND from.\[+.............\]:......after >> CONNECT:.GET./.HTTP/1.1 >> >> NON-SMTP COMMAND from [64.62.197.214]:13465 after CONNECT: GET / HTTP/1.1 >> >> >> >> But what are wrong here? >> >> thanks >> >> >> >> *Von:* Arturo 'Buanzo' Busleiman < bu...@bu... > >> <bu...@bu...> >> *Gesendet:* Montag, 20. Mai 2024 12:47 >> *An:* mau...@ca... >> *Cc:* Fail 2 Ban <Fai...@li...> >> <Fai...@li...> >> *Betreff:* Re: [Fail2ban-users] Fail2ban V1.1.0 from Github - question >> Regex >> >> >> >> Use pyrex or any python compatible one. Also be mindful of interpreting >> the filter definitions in filter.d and using fail2ban-regex as testing >> ground. >> >> >> >> >> >> >> >> On Mon, May 20, 2024, 07:21 Maurizio Caloro via Fail2ban-users < >> fai...@li...> wrote: >> >> Hello >> >> Please i think the Version 1.1.0 are the newest Version from Fail2ban? >> >> >> >> Support this now full regex?, i see meny time, that i puzzle on regex101 >> me syntax and after implement >> >> This to live system, this will be always chane. >> >> >> >> So this question, about Regex compatilities ? >> >> Thanks >> >> _______________________________________________ >> Fail2ban-users mailing list >> Fai...@li... >> https://lists.sourceforge.net/lists/listinfo/fail2ban-users >> >> >> >> >> _______________________________________________ >> >> Fail2ban-users mailing list >> >> Fai...@li... >> >> https://lists.sourceforge.net/lists/listinfo/fail2ban-users >> >> >> > > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users > > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users > |
From: Maurizio C. <mau...@ca...> - 2024-05-20 14:11:49
|
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr"><meta http-equiv="content-type" content="text/html; charset=utf-8">Its mostly important that i understod the Syntax, so i found the devlopment documentation from version 0.9. so here it’s a overview of the right syntax.<div><br></div><div>One syntax arn‘t important, the global perspective are the better road.</div><div><br></div><div>Thanks</div><div><br id="lineBreakAtBeginningOfSignature"><div dir="ltr">Von meinem iPhone gesendet</div><div dir="ltr"><br><blockquote type="cite">Am 20.05.2024 um 14:55 schrieb Nick Howitt via Fail2ban-users <fai...@li...>:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> You also need to give us a bit more help, like examples of the failed log you are trying to match.<br> <br> BTW, why try to match a port with \w+ and not \d+? And why \w+?.<br> <br> <div class="moz-cite-prefix">On 20/05/2024 13:36, Arturo 'Buanzo' Busleiman wrote:<br> </div> <blockquote type="cite" cite="mid:CAA...@ma..."> <meta http-equiv="content-type" content="text/html; charset=UTF-8"> <div dir="auto">It would seem that you need to learn more regex before attempting to write fail2ban custom filters. It is in fact a common syntax. You just need to read about the particulars. <div dir="auto"><br> </div> <div dir="auto">Please use fail2ban-regex command to test and learn.</div> <div dir="auto"><br> </div> <div dir="auto">Bye!</div> </div> <br> <div class="gmail_quote"> <div dir="ltr" class="gmail_attr">On Mon, May 20, 2024, 09:28 Maurizio Caloro <<a href="mailto:mau...@ca..." moz-do-not-send="true" class="moz-txt-link-freetext">mau...@ca...</a>> wrote:<br> </div> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div link="blue" vlink="purple" style="word-wrap:break-word" lang="DE-CH"> <div class="m_995798941233642463WordSection1"> <p class="MsoNormal"><span style="font-size:11.0pt">Yes, thanks, yes thats true</span></p> <ul style="margin-top:0cm" type="disc"> <li class="m_995798941233642463MsoListParagraph" style="margin-left:17.4pt"><span style="font-size:11.0pt">«.\[<HOST>\]:\ »</span></li> </ul> <p class="MsoNormal"><span style="font-size:11.0pt">but when i add this for example to pyrex, this didnt match.</span></p> <p class="MsoNormal"><span style="font-size:11.0pt"> </span></p> <p class="MsoNormal"><span style="font-size:11.0pt">So its not possible to find any «regexeditor» that match with fail2ban so that i can simulate this?</span></p> <p class="MsoNormal"><span style="font-size:11.0pt" lang="FR-CH">This also is a valid string, this match on « Regex101 python « but not with fail2ban</span></p> <ul style="margin-top:0cm" type="disc"> <li class="m_995798941233642463MsoListParagraph" style="margin-left:17.4pt"><span style="font-size:11.0pt">:\w+:\w+-\w+\w+\w+\w+\[<HOST>\]:\w+?w+?1.1</span></li> </ul> <p class="MsoNormal"><span style="font-size:11.0pt"> </span></p> <p class="MsoNormal"><span style="font-size:11.0pt">Sorry i have not yet understood which editor i can use for sim, or is fail2ban a separate unic regex Interpreter?</span></p> <p class="MsoNormal"><span style="font-size:11.0pt">Thanks for update</span></p> <p class="MsoNormal"><span style="font-size:11.0pt"> </span></p> <div> <div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm"> <p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif" lang="DE">Von:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif" lang="DE"> Nick Howitt via Fail2ban-users <<a href="mailto:fai...@li..." target="_blank" rel="noreferrer" moz-do-not-send="true" class="moz-txt-link-freetext">fai...@li...</a>> <br> <b>Gesendet:</b> Montag, 20. Mai 2024 13:53<br> <b>An:</b> <a href="mailto:fai...@li..." target="_blank" rel="noreferrer" moz-do-not-send="true" class="moz-txt-link-freetext">fai...@li...</a><br> <b>Betreff:</b> Re: [Fail2ban-users] Fail2ban V1.1.0 from Github - question Regex</span></p> </div> </div> <p class="MsoNormal"> </p> <p class="MsoNormal" style="margin-bottom:12.0pt">Surely you need a <HOST> variable in that for f2b to work. Something like:<br> <br> <span lang="FR-CH">NON-SMTP COMMAND from.\[<HOST>\]:\d+ after CONNECT:.GET./.HTTP/1.1</span><br> <br> Normally you'd also expect some sort of timestamp in the logs.</p> <div> <p class="MsoNormal">On 20/05/2024 12:37, Maurizio Caloro via Fail2ban-users wrote:</p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> <p class="MsoNormal"><span style="font-size:11.0pt">Thanks for your answer</span></p> <p class="MsoNormal"><span style="font-size:11.0pt"> </span></p> <p class="MsoNormal"><span style="font-size:11.0pt">Please, after generate this syntax, no chance to include this to Fail2ban.</span></p> <p class="MsoNormal"><span style="font-size:11.0pt">From 4389 found 0 hits</span></p> <p class="MsoNormal"><span style="font-size:11.0pt"> </span></p> <p class="MsoNormal"><span style="font-size:11.0pt" lang="FR-CH">[Appl PyRex]</span></p> <p class="MsoNormal"><span lang="FR-CH">NON-SMTP COMMAND from.\[+.............\]:......after CONNECT:.GET./.HTTP/1.1</span></p> <p class="MsoNormal"><span style="color:black;background:#c6e3ff" lang="FR-CH">NON-SMTP COMMAND from [64.62.197.214]:13465 after CONNECT: GET / HTTP/1.1</span></p> <p class="MsoNormal"><span style="color:black;background:#c6e3ff" lang="FR-CH"> </span></p> <p class="MsoNormal"><span style="font-size:11.0pt">But what are wrong here?</span></p> <p class="MsoNormal"><span style="font-size:11.0pt">thanks</span></p> <p class="MsoNormal"><span style="font-size:11.0pt"> </span></p> <div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm"> <p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif" lang="DE">Von:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif" lang="DE"> Arturo 'Buanzo' Busleiman <a href="mailto:bu...@bu..." target="_blank" rel="noreferrer" moz-do-not-send="true"><<span style="font-size:12.0pt;font-family:"Aptos",sans-serif;color:windowtext;text-decoration:none"> </span><span style="color:windowtext">bu...@bu...</span> ></a> <br> <b>Gesendet:</b> Montag, 20. Mai 2024 12:47<br> <b>An:</b> <a href="mailto:mau...@ca..." target="_blank" rel="noreferrer" moz-do-not-send="true" class="moz-txt-link-freetext">mau...@ca...</a><br> <b>Cc:</b> Fail 2 Ban <a href="mailto:Fai...@li..." target="_blank" rel="noreferrer" moz-do-not-send="true"><Fai...@li...></a><br> <b>Betreff:</b> Re: [Fail2ban-users] Fail2ban V1.1.0 from Github - question Regex</span></p> </div> <p class="MsoNormal"> </p> <div> <p class="MsoNormal">Use pyrex or any python compatible one. Also be mindful of interpreting the filter definitions in filter.d and using fail2ban-regex as testing ground.</p> <div> <p class="MsoNormal"> </p> </div> <div> <p class="MsoNormal"> </p> </div> </div> <p class="MsoNormal"> </p> <div> <div> <p class="MsoNormal">On Mon, May 20, 2024, 07:21 Maurizio Caloro via Fail2ban-users <<a href="mailto:fai...@li..." target="_blank" rel="noreferrer" moz-do-not-send="true" class="moz-txt-link-freetext">fai...@li...</a>> wrote:</p> </div> <blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt"> <div> <div> <p class="MsoNormal"><span lang="DE">Hello</span></p> <p class="MsoNormal">Please i think the Version 1.1.0 are the newest Version from Fail2ban?</p> <p class="MsoNormal"> </p> <p class="MsoNormal"><span lang="FR-CH">Support this now full regex?, i see meny time, that i puzzle on regex101 me syntax and after implement</span></p> <p class="MsoNormal">This to live system, this will be always chane.</p> <p class="MsoNormal"> </p> <p class="MsoNormal"><span lang="FR-CH">So this question, about Regex compatilities ?</span></p> <p class="MsoNormal"><span lang="FR-CH">Thanks</span></p> </div> </div> <p class="MsoNormal">_______________________________________________<br> Fail2ban-users mailing list<br> <a href="mailto:Fai...@li..." target="_blank" rel="noreferrer" moz-do-not-send="true" class="moz-txt-link-freetext">Fai...@li...</a><br> <a href="https://lists.sourceforge.net/lists/listinfo/fail2ban-users" target="_blank" rel="noreferrer" moz-do-not-send="true" class="moz-txt-link-freetext">https://lists.sourceforge.net/lists/listinfo/fail2ban-users</a></p> </blockquote> </div> <p class="MsoNormal"><br> <br> <br> </p> <pre>_______________________________________________</pre> <pre>Fail2ban-users mailing list</pre> <pre><a href="mailto:Fai...@li..." target="_blank" rel="noreferrer" moz-do-not-send="true" class="moz-txt-link-freetext">Fai...@li...</a></pre> <pre><a href="https://lists.sourceforge.net/lists/listinfo/fail2ban-users" target="_blank" rel="noreferrer" moz-do-not-send="true" class="moz-txt-link-freetext">https://lists.sourceforge.net/lists/listinfo/fail2ban-users</a></pre> </blockquote> <p class="MsoNormal"> </p> </div> </div> </blockquote> </div> </blockquote> <br> <lt-container></lt-container> <span>_______________________________________________</span><br><span>Fail2ban-users mailing list</span><br><span>Fai...@li...</span><br><span>https://lists.sourceforge.net/lists/listinfo/fail2ban-users</span><br></div></blockquote></div></div></body></html> |
From: Nick H. <ni...@ho...> - 2024-05-20 12:54:31
|
You also need to give us a bit more help, like examples of the failed log you are trying to match. BTW, why try to match a port with \w+ and not \d+? And why \w+?. On 20/05/2024 13:36, Arturo 'Buanzo' Busleiman wrote: > It would seem that you need to learn more regex before attempting to > write fail2ban custom filters. It is in fact a common syntax. You just > need to read about the particulars. > > Please use fail2ban-regex command to test and learn. > > Bye! > > On Mon, May 20, 2024, 09:28 Maurizio Caloro <mau...@ca...> wrote: > > Yes, thanks, yes thats true > > * «.\[<HOST>\]:\ » > > but when i add this for example to pyrex, this didnt match. > > So its not possible to find any «regexeditor» that match with > fail2ban so that i can simulate this? > > This also is a valid string, this match on « Regex101 python « but > not with fail2ban > > * :\w+:\w+-\w+\w+\w+\w+\[<HOST>\]:\w+?w+?1.1 > > Sorry i have not yet understood which editor i can use for sim, or > is fail2ban a separate unic regex Interpreter? > > Thanks for update > > *Von:*Nick Howitt via Fail2ban-users > <fai...@li...> > *Gesendet:* Montag, 20. Mai 2024 13:53 > *An:* fai...@li... > *Betreff:* Re: [Fail2ban-users] Fail2ban V1.1.0 from Github - > question Regex > > Surely you need a <HOST> variable in that for f2b to work. > Something like: > > NON-SMTP COMMAND from.\[<HOST>\]:\d+ after CONNECT:.GET./.HTTP/1.1 > > Normally you'd also expect some sort of timestamp in the logs. > > On 20/05/2024 12:37, Maurizio Caloro via Fail2ban-users wrote: > > Thanks for your answer > > Please, after generate this syntax, no chance to include this > to Fail2ban. > > From 4389 found 0 hits > > [Appl PyRex] > > NON-SMTP COMMAND from.\[+.............\]:......after > CONNECT:.GET./.HTTP/1.1 > > NON-SMTP COMMAND from [64.62.197.214]:13465 after CONNECT: GET > / HTTP/1.1 > > But what are wrong here? > > thanks > > *Von:*Arturo 'Buanzo' Busleiman <bu...@bu... > > <mailto:bu...@bu...> > *Gesendet:* Montag, 20. Mai 2024 12:47 > *An:* mau...@ca... > *Cc:* Fail 2 Ban <Fai...@li...> > <mailto:Fai...@li...> > *Betreff:* Re: [Fail2ban-users] Fail2ban V1.1.0 from Github - > question Regex > > Use pyrex or any python compatible one. Also be mindful of > interpreting the filter definitions in filter.d and using > fail2ban-regex as testing ground. > > On Mon, May 20, 2024, 07:21 Maurizio Caloro via Fail2ban-users > <fai...@li...> wrote: > > Hello > > Please i think the Version 1.1.0 are the newest Version > from Fail2ban? > > Support this now full regex?, i see meny time, that i > puzzle on regex101 me syntax and after implement > > This to live system, this will be always chane. > > So this question, about Regex compatilities ? > > Thanks > > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users > > > > > _______________________________________________ > > Fail2ban-users mailing list > > Fai...@li... > > https://lists.sourceforge.net/lists/listinfo/fail2ban-users > |
From: Arturo 'B. B. <bu...@bu...> - 2024-05-20 12:36:26
|
It would seem that you need to learn more regex before attempting to write fail2ban custom filters. It is in fact a common syntax. You just need to read about the particulars. Please use fail2ban-regex command to test and learn. Bye! On Mon, May 20, 2024, 09:28 Maurizio Caloro <mau...@ca...> wrote: > Yes, thanks, yes thats true > > - «.\[<HOST>\]:\ » > > but when i add this for example to pyrex, this didnt match. > > > > So its not possible to find any «regexeditor» that match with fail2ban so > that i can simulate this? > > This also is a valid string, this match on « Regex101 python « but not > with fail2ban > > - :\w+:\w+-\w+\w+\w+\w+\[<HOST>\]:\w+?w+?1.1 > > > > Sorry i have not yet understood which editor i can use for sim, or is > fail2ban a separate unic regex Interpreter? > > Thanks for update > > > > *Von:* Nick Howitt via Fail2ban-users < > fai...@li...> > *Gesendet:* Montag, 20. Mai 2024 13:53 > *An:* fai...@li... > *Betreff:* Re: [Fail2ban-users] Fail2ban V1.1.0 from Github - question > Regex > > > > Surely you need a <HOST> variable in that for f2b to work. Something like: > > NON-SMTP COMMAND from.\[<HOST>\]:\d+ after CONNECT:.GET./.HTTP/1.1 > > Normally you'd also expect some sort of timestamp in the logs. > > On 20/05/2024 12:37, Maurizio Caloro via Fail2ban-users wrote: > > Thanks for your answer > > > > Please, after generate this syntax, no chance to include this to Fail2ban. > > From 4389 found 0 hits > > > > [Appl PyRex] > > NON-SMTP COMMAND from.\[+.............\]:......after > CONNECT:.GET./.HTTP/1.1 > > NON-SMTP COMMAND from [64.62.197.214]:13465 after CONNECT: GET / HTTP/1.1 > > > > But what are wrong here? > > thanks > > > > *Von:* Arturo 'Buanzo' Busleiman < bu...@bu... > > <bu...@bu...> > *Gesendet:* Montag, 20. Mai 2024 12:47 > *An:* mau...@ca... > *Cc:* Fail 2 Ban <Fai...@li...> > <Fai...@li...> > *Betreff:* Re: [Fail2ban-users] Fail2ban V1.1.0 from Github - question > Regex > > > > Use pyrex or any python compatible one. Also be mindful of interpreting > the filter definitions in filter.d and using fail2ban-regex as testing > ground. > > > > > > > > On Mon, May 20, 2024, 07:21 Maurizio Caloro via Fail2ban-users < > fai...@li...> wrote: > > Hello > > Please i think the Version 1.1.0 are the newest Version from Fail2ban? > > > > Support this now full regex?, i see meny time, that i puzzle on regex101 > me syntax and after implement > > This to live system, this will be always chane. > > > > So this question, about Regex compatilities ? > > Thanks > > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users > > > > > _______________________________________________ > > Fail2ban-users mailing list > > Fai...@li... > > https://lists.sourceforge.net/lists/listinfo/fail2ban-users > > > |
From: Maurizio C. <mau...@ca...> - 2024-05-20 12:28:43
|
Yes, thanks, yes thats true * «.\[<HOST>\]:\ » but when i add this for example to pyrex, this didnt match. So its not possible to find any «regexeditor» that match with fail2ban so that i can simulate this? This also is a valid string, this match on « Regex101 python « but not with fail2ban * :\w+:\w+-\w+\w+\w+\w+\[<HOST>\]:\w+?w+?1.1 Sorry i have not yet understood which editor i can use for sim, or is fail2ban a separate unic regex Interpreter? Thanks for update Von: Nick Howitt via Fail2ban-users <fai...@li...> Gesendet: Montag, 20. Mai 2024 13:53 An: fai...@li... Betreff: Re: [Fail2ban-users] Fail2ban V1.1.0 from Github - question Regex Surely you need a <HOST> variable in that for f2b to work. Something like: NON-SMTP COMMAND from.\[<HOST>\]:\d+ after CONNECT:.GET./.HTTP/1.1 Normally you'd also expect some sort of timestamp in the logs. On 20/05/2024 12:37, Maurizio Caloro via Fail2ban-users wrote: Thanks for your answer Please, after generate this syntax, no chance to include this to Fail2ban. >From 4389 found 0 hits [Appl PyRex] NON-SMTP COMMAND from.\[+.............\]:......after CONNECT:.GET./.HTTP/1.1 NON-SMTP COMMAND from [64.62.197.214]:13465 after CONNECT: GET / HTTP/1.1 But what are wrong here? thanks Von: Arturo 'Buanzo' Busleiman <mailto:bu...@bu...> < bu...@bu... > Gesendet: Montag, 20. Mai 2024 12:47 An: mau...@ca... <mailto:mau...@ca...> Cc: Fail 2 Ban <mailto:Fai...@li...> <Fai...@li...> Betreff: Re: [Fail2ban-users] Fail2ban V1.1.0 from Github - question Regex Use pyrex or any python compatible one. Also be mindful of interpreting the filter definitions in filter.d and using fail2ban-regex as testing ground. On Mon, May 20, 2024, 07:21 Maurizio Caloro via Fail2ban-users <fai...@li... <mailto:fai...@li...> > wrote: Hello Please i think the Version 1.1.0 are the newest Version from Fail2ban? Support this now full regex?, i see meny time, that i puzzle on regex101 me syntax and after implement This to live system, this will be always chane. So this question, about Regex compatilities ? Thanks _______________________________________________ Fail2ban-users mailing list Fai...@li... <mailto:Fai...@li...> https://lists.sourceforge.net/lists/listinfo/fail2ban-users _______________________________________________ Fail2ban-users mailing list Fai...@li... <mailto:Fai...@li...> https://lists.sourceforge.net/lists/listinfo/fail2ban-users |
From: Nick H. <ni...@ho...> - 2024-05-20 12:10:11
|
Surely you need a <HOST> variable in that for f2b to work. Something like: NON-SMTP COMMAND from.\[<HOST>\]:\d+ after CONNECT:.GET./.HTTP/1.1 Normally you'd also expect some sort of timestamp in the logs. On 20/05/2024 12:37, Maurizio Caloro via Fail2ban-users wrote: > > Thanks for your answer > > Please, after generate this syntax, no chance to include this to Fail2ban. > > From 4389 found 0 hits > > [Appl PyRex] > > NON-SMTP COMMAND from.\[+.............\]:......after > CONNECT:.GET./.HTTP/1.1 > > NON-SMTP COMMAND from [64.62.197.214]:13465 after CONNECT: GET / HTTP/1.1 > > But what are wrong here? > > thanks > > *Von:*Arturo 'Buanzo' Busleiman <bu...@bu...> > *Gesendet:* Montag, 20. Mai 2024 12:47 > *An:* mau...@ca... > *Cc:* Fail 2 Ban <Fai...@li...> > *Betreff:* Re: [Fail2ban-users] Fail2ban V1.1.0 from Github - question > Regex > > Use pyrex or any python compatible one. Also be mindful of > interpreting the filter definitions in filter.d and using > fail2ban-regex as testing ground. > > On Mon, May 20, 2024, 07:21 Maurizio Caloro via Fail2ban-users > <fai...@li...> wrote: > > Hello > > Please i think the Version 1.1.0 are the newest Version from Fail2ban? > > Support this now full regex?, i see meny time, that i puzzle on > regex101 me syntax and after implement > > This to live system, this will be always chane. > > So this question, about Regex compatilities ? > > Thanks > > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users > > > > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users |
From: Maurizio C. <mau...@ca...> - 2024-05-20 11:38:09
|
Thanks for your answer Please, after generate this syntax, no chance to include this to Fail2ban. >From 4389 found 0 hits [Appl PyRex] NON-SMTP COMMAND from.\[+.............\]:......after CONNECT:.GET./.HTTP/1.1 NON-SMTP COMMAND from [64.62.197.214]:13465 after CONNECT: GET / HTTP/1.1 But what are wrong here? thanks Von: Arturo 'Buanzo' Busleiman <bu...@bu...> Gesendet: Montag, 20. Mai 2024 12:47 An: mau...@ca... Cc: Fail 2 Ban <Fai...@li...> Betreff: Re: [Fail2ban-users] Fail2ban V1.1.0 from Github - question Regex Use pyrex or any python compatible one. Also be mindful of interpreting the filter definitions in filter.d and using fail2ban-regex as testing ground. On Mon, May 20, 2024, 07:21 Maurizio Caloro via Fail2ban-users <fai...@li... <mailto:fai...@li...> > wrote: Hello Please i think the Version 1.1.0 are the newest Version from Fail2ban? Support this now full regex?, i see meny time, that i puzzle on regex101 me syntax and after implement This to live system, this will be always chane. So this question, about Regex compatilities ? Thanks _______________________________________________ Fail2ban-users mailing list Fai...@li... <mailto:Fai...@li...> https://lists.sourceforge.net/lists/listinfo/fail2ban-users |
From: Arturo 'B. B. <bu...@bu...> - 2024-05-20 11:15:46
|
Use pyrex or any python compatible one. Also be mindful of interpreting the filter definitions in filter.d and using fail2ban-regex as testing ground. On Mon, May 20, 2024, 07:21 Maurizio Caloro via Fail2ban-users < fai...@li...> wrote: > Hello > > Please i think the Version 1.1.0 are the newest Version from Fail2ban? > > > > Support this now full regex?, i see meny time, that i puzzle on regex101 > me syntax and after implement > > This to live system, this will be always chane. > > > > So this question, about Regex compatilities ? > > Thanks > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users > |
From: Maurizio C. <mau...@ca...> - 2024-05-20 10:11:15
|
Hello Please i think the Version 1.1.0 are the newest Version from Fail2ban? Support this now full regex?, i see meny time, that i puzzle on regex101 me syntax and after implement This to live system, this will be always chane. So this question, about Regex compatilities ? Thanks |
From: Steve N. <sr...@co...> - 2024-05-13 13:35:43
|
The line breaks you found (or perhaps created) are spurious artifacts. The backslashes that you added at the ends of the broken lines fix the spurious-linebreaks problem by telling your shell (bash?) to ignore them. Another way around the problem is to remove the spurious line breaks so they don't confuse your shell. Of course, that would make the command line very long indeed, but it *is* a very long line, regardless of whether you escape some inserted line breaks. On 5/13/24 09:01, Marco Moock wrote: > Am 10.05.2024 um 09:29:39 Uhr schrieb Steve Newcomb: > >> % python3 -c "import re; print( re.compile( r'^[0-3][0-9][ >> \t]+[A-Z][a-z]{2}[ \t]+20[23][0-9][ >> \t]+[0-2][0-9]:[0-5][0-9]:[0-5][0-9]').search( '10 May 2024 >> 09:16:18'))" > It only works by using \ at the end. > m@ryz:~$ python3 -c "import re; print( re.compile( r'^[0-3][0-9][\ > \t]+[A-Z][a-z]{2}[ \t]+20[23][0-9][\ > \t]+[0-2][0-9]:[0-5][0-9]:[0-5][0-9]').search( '10 May 2024 09:16:18'))" > None > m@ryz:~$ > > What does that mean? > For me it looks like the regex doesn't match. |
From: Marco M. <mm...@do...> - 2024-05-13 13:01:27
|
Am 10.05.2024 um 09:29:39 Uhr schrieb Steve Newcomb: > % python3 -c "import re; print( re.compile( r'^[0-3][0-9][ > \t]+[A-Z][a-z]{2}[ \t]+20[23][0-9][ > \t]+[0-2][0-9]:[0-5][0-9]:[0-5][0-9]').search( '10 May 2024 > 09:16:18'))" It only works by using \ at the end. m@ryz:~$ python3 -c "import re; print( re.compile( r'^[0-3][0-9][\ \t]+[A-Z][a-z]{2}[ \t]+20[23][0-9][\ \t]+[0-2][0-9]:[0-5][0-9]:[0-5][0-9]').search( '10 May 2024 09:16:18'))" None m@ryz:~$ What does that mean? For me it looks like the regex doesn't match. |
From: Marco M. <mm...@do...> - 2024-05-10 11:07:34
|
Hello! I've a listserv log that should be checked by fail2ban. The lines begin with 10 May 2024 09:16:18 This isn't being auto-detected by f2b. I've tried the following regex. datepattern = %%d\s%%b\s%%Y\s%%H:%%M:%%S I've also tried it with spaces instead of \s. Both give me python tracebacks. What is the proper way to diagnose the issue in the datepattern regex? -- kind regards Marco |
From: eBulldog O. <op...@eb...> - 2024-04-10 13:39:29
|
Hi and thanks for reading ... I've scoured the usual sources and whilst I'm convinced I'm not the first with this config challenge, I can't find anything appropriate. The issue appears to be the additional fields (timestamp/hostname/process) that journal is adding to the original dovecot log lines. Now there's a bunch of work arounds for this but I'm trying to avoid hacks and also convinced fail2ban can handle this in itself (and I'm just being dumb). Currently exploring the common.conf macro's and how they work (e.g. logtype = journal) and if/how this could be modified to handle journal entries but my assumption is I'm missing something obvious as I can't imagine I'm the first to need to filter out the additional fields for the regex to work out of the box. If anyone has any pointers here it will be much appreciated, an hour or two saved as I'm burning through them ;) Some more detail ... Dovecot docker container logging to stdout (no rsyslog in the middle), docker configured to log to journal. -docker logs: Apr 10 13:10:14 submission-login: Info: Disconnected: Connection closed (auth failed, 1 attempts in 23 secs): user=<squ...@yo...>, method=LOGIN, rip=194.169.175.10, lip=172.20.0.4, TLS: Connection closed, session=<EzX/wL0V8KnCqa8K> -journal logs: Apr 10 13:10:14 toad be63bba8ba56[2836635]: Apr 10 13:10:14 submission-login: Info: Disconnected: Connection closed (auth failed, 1 attempts in 23 secs): user=<squ...@yo...>, method=LOGIN, rip=194.169.175.10, lip=172.20.0.4, TLS: Connection closed, session=<EzX/wL0V8KnCqa8K> NOTE: additonal timestamp etc - Control test: journalctl -u docker.service CONTAINER_NAME=ms-dovecot --output cat > dovecot-native.logs fail2ban-regex ./dovecot-native.logs dovecot NOTE: everything works, 100's of Failregex counted (14k lines via Prefregex) fail2ban-regex systemd-journal -m 'CONTAINER_NAME=ms-dovecot' dovecot NOTE: Prefregex counts 14k lines but zero Failregex. |
From: James M. <moe...@sm...> - 2024-03-06 17:37:34
|
On 2024-03-06 05:54, Jason Long wrote: > Thanks. > I need this strategy for SSH service. > Change the port number(s). -- James Moe moe dot james at sohnen-moe dot com 520.743.3936 Think. |
From: lejeczek <pe...@ya...> - 2024-03-06 16:33:53
|
Hi guys. With banaction as above my _fail2ban_ inject rules into _default_ zone - is this by design or I misconfigured my setup? The way _fail2ban_ does it for me seems to me, is broken, defeats the purpose - no? _zone_ when in use will(should) use a given iface(s) - in my case it's a zone with one specific, public-facing interface, which zone is not "default" zone so... what _fail2ban_ does is, well.. useless. This must not be a bug ? what am I missing in terms of config? I'm on Centos 9 with ver. 1.3.4 many thanks, L. |
From: Jason L. <hac...@ya...> - 2024-03-06 12:54:58
|
> On Tuesday, March 5, 2024 at 11:36:49 PM GMT+3:30, James Moe via Fail2ban-users <fai...@li...> wrote: > On 2024-03-05 04:14, Jason Long via Fail2ban-users wrote: > How can I block someone who has entered the wrong password three times in any given time period? --[ Jail definition ]-- bantime.increment = true bantime.factor = 1 bantime.formula = ban.Time * (1<<(ban.Count if ban.Count<20 else 20)) * banFactor [jail-name] enabled = true port = smtp,465,submission logpath = /path/to/maillog.txt datepattern = %%Y-%%m-%%d_%%H:%%M:%%S logencoding = utf-8 # # bantime = 26w 15h bantime = 182.62d maxretry = 3 findtime = 2w action = iptables-multiport[name=jname, port="smtp,465,submission", protocol=tcp] --[ end ]-- Then create a filter in filter.d that matches the failed login log entry. -- James Moe moe dot james at sohnen-moe dot com 520.743.3936 Think. _______________________________________________ Fail2ban-users mailing list Fai...@li... https://lists.sourceforge.net/lists/listinfo/fail2ban-users Hello, Thanks. I need this strategy for SSH service. |
From: James M. <moe...@sm...> - 2024-03-05 20:03:21
|
On 2024-03-05 04:14, Jason Long via Fail2ban-users wrote: > How can I block someone who has entered the wrong password three times in any given time period? --[ Jail definition ]-- bantime.increment = true bantime.factor = 1 bantime.formula = ban.Time * (1<<(ban.Count if ban.Count<20 else 20)) * banFactor [jail-name] enabled = true port = smtp,465,submission logpath = /path/to/maillog.txt datepattern = %%Y-%%m-%%d_%%H:%%M:%%S logencoding = utf-8 # # bantime = 26w 15h bantime = 182.62d maxretry = 3 findtime = 2w action = iptables-multiport[name=jname, port="smtp,465,submission", protocol=tcp] --[ end ]-- Then create a filter in filter.d that matches the failed login log entry. -- James Moe moe dot james at sohnen-moe dot com 520.743.3936 Think. |
From: Jason L. <hac...@ya...> - 2024-03-05 11:18:48
|
> Why not just enable the nginx-http-auth config in jail.conf (using a jail.local, preferably)? > On 05/03/2024 09:57, Jason Long via Fail2ban-users wrote: > Hello, > GitLab uses Nginx and PostgreSQL internally. I want to protect Nginx with Fail2Ban. The GitLab log directory contains the following files: > > # ls /var/log/gitlab/nginx/ > access.log config current error.log gitlab_access.log gitlab_access.log.1.gz gitlab_error.log lock > > > Is the following Fail2Ban configuration OK? > > [nginx-http-auth] > enabled = true > port = http,https > logpath = /var/log/gitlab/nginx/*error.log > findtime = 600 > bantime = 7200 > maxretry = 3 > > Thank you. > > > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users _______________________________________________ Fail2ban-users mailing list Fai...@li... https://lists.sourceforge.net/lists/listinfo/fail2ban-users Hello, Thanks. The problem is the "logpath" value. As I said, this is not a normal Nginx installation. |
From: Jason L. <hac...@ya...> - 2024-03-05 11:15:01
|
Hello, How can I block someone who has entered the wrong password three times in any given time period? Thanks. |
From: Nick H. <ni...@ho...> - 2024-03-05 11:09:52
|
Why not just enable the nginx-http-auth config in jail.conf (using a jail.local, preferably)? On 05/03/2024 09:57, Jason Long via Fail2ban-users wrote: > Hello, > GitLab uses Nginx and PostgreSQL internally. I want to protect Nginx with Fail2Ban. The GitLab log directory contains the following files: > > # ls /var/log/gitlab/nginx/ > access.log config current error.log gitlab_access.log gitlab_access.log.1.gz gitlab_error.log lock > > > Is the following Fail2Ban configuration OK? > > [nginx-http-auth] > enabled = true > port = http,https > logpath = /var/log/gitlab/nginx/*error.log > findtime = 600 > bantime = 7200 > maxretry = 3 > > Thank you. > > > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users |