On 17/04/2023 18:19, Wayne Sallee via Fail2ban-users wrote:
-------- Original Message --------*Subject: * Re: [Fail2ban-users] fail2ban-regex maches, but fail2ban does not *From: * James Moe Via Fail2ban-users <fail2ban-users@lists.sourceforge.net>*To: * Fail2ban-users <fail2ban-users@lists.sourceforge.net> *CC: * *Date: * 2023-4-17 12:50 PMOn 2023-04-17 08:27, Wayne Sallee via Fail2ban-users wrote:Why does fail2ban not match when fail2ban-regex does match? It makes fail2ban-regex almost useless.Are you responding to another message? Do you have a specific issue?My issue is that I can use an online regex like https://regex101.com and get matches. But use fail2ban-regex, and get worse results,
You might be running into escaping problems here. For instance, if you wanted to match a single character of whitespace, regex101.com would tell you it's '\s'. However, if you pass this to fail2ban-regex on the command line, you'd find that it doesn't match. That's because the shell sees the backslash first (before failt2ban-regex) and interprets \s as a special character. To be safe, you'd have to write '\\s' on the command line (the first backslash escapes the second backslash and so fail2ban-regex actually sees the two characters of "\" and "s").
For this reason, it is safer to pass either a filename or a filter name to the REGEX argument of fail2ban-regex. This way, you're avoiding any shell-escaping issues AND the file that you end up testing SHOULD be read by fail2ban in the same way as fail2ban-regex (if not, raise a bug report?)
and then use fail2ban to get even worse results. Wayne Sallee wa...@waynesallee.com http://www.WayneSallee.com _______________________________________________ Fail2ban-users mailing list Fail2ban-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/fail2ban-users
OpenPGP_signature
Description: OpenPGP digital signature
_______________________________________________ Fail2ban-users mailing list Fail2ban-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/fail2ban-users
