From 33a6a98fea162bc3ee8f542e7dc09d85542475a0 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Fri, 4 Jan 2008 12:02:03 -0500 Subject: [PATCH] BF: vsftp anchoring it needed also optional user=, as well as optional (pam_unix) and removed 1 space also added .examples file for testing --- config/filter.d/vsftpd.conf | 2 +- config/filter.d/vsftpd.examples | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) create mode 100644 config/filter.d/vsftpd.examples diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf index 3775e803..f409e128 100644 --- a/config/filter.d/vsftpd.conf +++ b/config/filter.d/vsftpd.conf @@ -14,7 +14,7 @@ # (?:::f{4,6}:)?(?P\S+) # Values: TEXT # -failregex = vsftpd(?:\[\d+\])?: .* authentication failure; .* rhost=\s*$ +failregex = vsftpd(?:\(pam_unix\))?(?:\[\d+\])?:.* authentication failure; .* rhost=(?:\s+user=\S*)?\s*$ \[.+\] FAIL LOGIN: Client ""\s*$ # Option: ignoreregex diff --git a/config/filter.d/vsftpd.examples b/config/filter.d/vsftpd.examples new file mode 100644 index 00000000..a8b6a4cf --- /dev/null +++ b/config/filter.d/vsftpd.examples @@ -0,0 +1,7 @@ +#1 PAM based +Oct 11 01:06:47 ServerJV vsftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=209.67.1.67 +Feb 6 12:02:29 server vsftpd(pam_unix)[15522]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=64.168.103.1 user=user1 + +#2 Internal +Fri Jan 19 12:20:33 2007 [pid 27202] [anonymous] FAIL LOGIN: Client "64.106.46.98" +