From 08878d22dda512b2d01d0649a1cf0e86023d9b2d Mon Sep 17 00:00:00 2001
From: john <john@terabyteit.com.au>
Date: Tue, 29 Mar 2016 21:31:26 +1100
Subject: [PATCH] added zoneminder.conf filter

---
 config/filter.d/zoneminder.conf | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 config/filter.d/zoneminder.conf

diff --git a/config/filter.d/zoneminder.conf b/config/filter.d/zoneminder.conf
new file mode 100644
index 00000000..00da76d9
--- /dev/null
+++ b/config/filter.d/zoneminder.conf
@@ -0,0 +1,23 @@
+# Fail2Ban filter for Zoneminder login failures
+#
+
+[Definition]
+
+# patern :      [client 10.1.1.1:38022] WAR [Login denied for user "test"], referer: https://zoneminderurl/
+#
+#
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+
+
+failregex = [[]client <HOST>:\d\d\d\d\d] WAR [[]Login denied for user
+
+ignoreregex =
+
+# Notes:
+#	Tested on Zoneminder 1.29.0
+#
+# Author: John Marzella