From 3ec725a2ba50784ee3f17aa16e0e4eff63a89715 Mon Sep 17 00:00:00 2001
From: Simon Brown <simon_b@beezwax.net>
Date: Mon, 26 Oct 2015 17:35:38 -0700
Subject: [PATCH] Created file

From https://github.com/beezwax/filemaker-fail2ban/blob/master/fail2ban/filter.d/screensharingd.conf
---
 config/filter.d/screensharingd.conf | 33 +++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 config/filter.d/screensharingd.conf

diff --git a/config/filter.d/screensharingd.conf b/config/filter.d/screensharingd.conf
new file mode 100644
index 00000000..c0b5d32c
--- /dev/null
+++ b/config/filter.d/screensharingd.conf
@@ -0,0 +1,33 @@
+# Fail2Ban configuration file
+#
+# Author: Simon Brown
+#
+# $Revision: 1 $ 
+#
+# Filter for Mac OS X Screen Sharing service
+
+[INCLUDES]
+
+# Read common prefixes. If any customizations available -- read them from
+# common.local
+before = common.conf
+
+
+[Definition]
+
+_daemon = screensharingd
+
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+# Values:  TEXT
+#
+failregex = ^.+ screensharingd.+: Authentication: FAILED :: User Name: .+ :: Viewer Address: <HOST> :: .*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex =