diff --git a/ChangeLog b/ChangeLog index a3ac95ce..45c6f343 100644 --- a/ChangeLog +++ b/ChangeLog @@ -11,7 +11,8 @@ ver. 0.8.11 (2013/XX/XXX) - wanna-be-released ----------- - Fixes: - + Yaroslav Halchenko + * filter.d/common.conf -- make colon after [daemon] optional. Closes gh-267 - New Features: Daniel Black & ykimon * filter.d/3proxy.conf -- filter added diff --git a/config/filter.d/common.conf b/config/filter.d/common.conf index aafeb5ca..d44a6325 100644 --- a/config/filter.d/common.conf +++ b/config/filter.d/common.conf @@ -33,7 +33,7 @@ __daemon_extra_re = (?:\[ID \d+ \S+\]) # Combinations of daemon name and PID # EXAMPLES: sshd[31607], pop(pam_unix)[4920] -__daemon_combs_re = (?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:) +__daemon_combs_re = (?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:?) # Some messages have a kernel prefix with a timestamp # EXAMPLES: kernel: [769570.846956] diff --git a/testcases/files/logs/sshd b/testcases/files/logs/sshd index 5dab1606..1943fb37 100644 --- a/testcases/files/logs/sshd +++ b/testcases/files/logs/sshd @@ -46,3 +46,6 @@ Apr 29 15:53:38 Jamess-iMac.local sshd[47831]: error: PAM: Authentication error Apr 29 16:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.101 via 192.168.1.201 Apr 29 17:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.102 Apr 29 18:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.103 + +#11 https://github.com/fail2ban/fail2ban/issues/267 There might be no colon after [daemon] +Jun 25 23:53:34 [sshd] User root from 1.2.3.4 not allowed because not listed in AllowUsers