Roderick, sorry about the delay and thanks for the report.
Hi Cyril!
Here is a tiny bugreport from a Debian user. We should tune up
pure-ftpd's failregex a bit (and may be actually some other services as
well since this logging behavior is quite common). I thought it
would be easier simply to accomplish it upstream for the next release
you have.
Cheers
Yarik
On Fri, 25 May 2007, Roderick Schertler wrote:
> Package: fail2ban
> Version: 0.8.0-2
> Severity: normal
> Tags: patch
> filter.d/pure-ftpd.conf doesn't work if pure-ftpd has the LogPID option on.
> In this case the logged lines look like:
> May 25 20:52:47 gopher pure-ftpd[26108]: ([EMAIL PROTECTED]) [WARNING]
> Authentication failed for user [TST001-test]
> Here is a fix.
> --- pure-ftpd.conf.~1~ Mon Mar 19 16:24:39 2007
> +++ pure-ftpd.conf Fri May 25 16:59:24 2007
> @@ -19,7 +19,7 @@
> # (?:::f{4,6}:)?(?P<host>\S+)
> # Values: TEXT
> -failregex = pure-ftpd: (.+?@<HOST>) \[WARNING\] %(__errmsg)s \[.+\]$
> +failregex = pure-ftpd(?:\[\d+\])?: (.+?@<HOST>) \[WARNING\] %(__errmsg)s
> \[.+\]$
> # Option: ignoreregex
> # Notes.: regex to ignore. If this regex matches, the line is ignored.
--
Yaroslav Halchenko
Research Assistant, Psychology Department, Rutgers-Newark
Student Ph.D. @ CS Dept. NJIT
Office: (973) 353-5440x263 | FWD: 82823 | Fax: (973) 353-1171
101 Warren Str, Smith Hall, Rm 4-105, Newark NJ 07102
WWW: http://www.linkedin.com/in/yarik
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
