From: <yar...@us...> - 2011-03-23 20:37:16
|
Revision: 774 http://fail2ban.svn.sourceforge.net/fail2ban/?rev=774&view=rev Author: yarikoptic Date: 2011-03-23 20:37:10 +0000 (Wed, 23 Mar 2011) Log Message: ----------- BF: Allow for trailing spaces in proftpd logs See http://bugs.debian.org/507986 Modified Paths: -------------- branches/FAIL2BAN-0_8/config/filter.d/proftpd.conf Modified: branches/FAIL2BAN-0_8/config/filter.d/proftpd.conf =================================================================== --- branches/FAIL2BAN-0_8/config/filter.d/proftpd.conf 2011-03-23 20:37:00 UTC (rev 773) +++ branches/FAIL2BAN-0_8/config/filter.d/proftpd.conf 2011-03-23 20:37:10 UTC (rev 774) @@ -14,10 +14,10 @@ # (?:::f{4,6}:)?(?P<host>[\w\-.^_]+) # Values: TEXT # -failregex = \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+$ - \(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): Incorrect password\.$ - \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\.$ - \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded$ +failregex = \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+ *$ + \(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): Incorrect password\. *$ + \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\. *$ + \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded *$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |