From c6bd8fc80749417238280c84310f39fc1c4d103b Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Tue, 16 Apr 2013 21:09:53 +0100
Subject: [PATCH 1/2] ENH+TST: Add Apache Tomcat date format

---
 fail2ban/server/datedetector.py        | 6 ++++++
 fail2ban/tests/datedetectortestcase.py | 1 +
 2 files changed, 7 insertions(+)

diff --git a/fail2ban/server/datedetector.py b/fail2ban/server/datedetector.py
index f58ab4e0..88f0f228 100644
--- a/fail2ban/server/datedetector.py
+++ b/fail2ban/server/datedetector.py
@@ -161,6 +161,12 @@ class DateDetector:
 			template.setRegex("^\d{2}\d{2}\d{2} +\d{1,2}:\d{2}:\d{2}")
 			template.setPattern("%y%m%d %H:%M:%S")
 			self._appendTemplate(template)
+			# Apache Tomcat
+			template = DateStrptime()
+			template.setName("MONTH Day, Year 12hour:Minute:Second AM/PM")
+			template.setRegex("\S{3}\s{1,2}\d{1,2}, \d{4} \d{1,2}:\d{2}:\d{2} [AP]M")
+			template.setPattern("%b %d, %Y %I:%M:%S %p")
+			self._appendTemplate(template)
 		finally:
 			self.__lock.release()
 	
diff --git a/fail2ban/tests/datedetectortestcase.py b/fail2ban/tests/datedetectortestcase.py
index e30027e1..23f7a174 100644
--- a/fail2ban/tests/datedetectortestcase.py
+++ b/fail2ban/tests/datedetectortestcase.py
@@ -86,6 +86,7 @@ class DateDetectorTest(unittest.TestCase):
 			"2005-01-23T21:59:59-05:00Z", #ISO 8601 with TZ
 			"<01/23/05@21:59:59>",
 			"050123 21:59:59", # MySQL
+			"Jan 23, 2005 9:59:59 PM", # Apache Tomcat
 			):
 			log = sdate + "[sshd] error: PAM: Authentication failure"
 			# exclude

From 4d80fad87445f669a1517174d06e2c66c05616bd Mon Sep 17 00:00:00 2001
From: Steven Hiscocks <steven@hiscocks.me.uk>
Date: Tue, 16 Apr 2013 21:13:31 +0100
Subject: [PATCH 2/2] ENH+DOC: Add Guacamole filter, example log and jail

---
 config/filter.d/guacamole.conf      | 18 ++++++++++++++++++
 config/jail.conf                    | 10 ++++++++++
 fail2ban/tests/files/logs/guacamole |  6 ++++++
 3 files changed, 34 insertions(+)
 create mode 100644 config/filter.d/guacamole.conf
 create mode 100644 fail2ban/tests/files/logs/guacamole

diff --git a/config/filter.d/guacamole.conf b/config/filter.d/guacamole.conf
new file mode 100644
index 00000000..272460e3
--- /dev/null
+++ b/config/filter.d/guacamole.conf
@@ -0,0 +1,18 @@
+# Fail2Ban configuration file for guacamole
+#
+# Author: Steven Hiscocks
+#
+
+[Definition]
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT
+#
+failregex = ^.*\nWARNING: Authentication attempt from <HOST> for user "[^"]*" failed\.$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex = 
diff --git a/config/jail.conf b/config/jail.conf
index 4399d0bd..c331e914 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -357,6 +357,16 @@ action   = iptables[name=mysql, port=3306, protocol=tcp]
 logpath  = /var/log/mysqld.log
 maxretry = 5
 
+[guacamole-iptables]
+
+enabled  = false
+filter   = guacamole
+action   = iptables-multiport[name=Guacmole, port="http,https"]
+           sendmail-whois[name=Guacamole, dest=root, sender=fail2ban@example.com]
+logpath  = /var/log/tomcat*/catalina.out
+maxretry = 5
+maxlines = 2
+
 
 # Jail for more extended banning of persistent abusers
 # !!! WARNING !!!
diff --git a/fail2ban/tests/files/logs/guacamole b/fail2ban/tests/files/logs/guacamole
new file mode 100644
index 00000000..b0f82f30
--- /dev/null
+++ b/fail2ban/tests/files/logs/guacamole
@@ -0,0 +1,6 @@
+apr 15, 2013 8:34:08 PM org.slf4j.impl.JCLLoggerAdapter warn
+WARNING: Authentication attempt from 192.0.2.0 for user "null" failed.
+apr 16, 2013 8:32:13 AM org.slf4j.impl.JCLLoggerAdapter warn
+WARNING: Authentication attempt from 192.0.2.0 for user "null" failed.
+apr 16, 2013 8:32:28 AM org.slf4j.impl.JCLLoggerAdapter warn
+WARNING: Authentication attempt from 192.0.2.0 for user "pippo" failed.