From c7f7bc55bbd36b6c3009af9dad0cb311da93d355 Mon Sep 17 00:00:00 2001
From: Rajib Sharia <rajibsharia@gmail.com>
Date: Tue, 1 Apr 2025 20:36:53 +0800
Subject: [PATCH] Create vaultwarden.conf

Filter for unsuccessful Vaultwarden authentication attempts
---
 config/filter.d/vaultwarden.conf | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 config/filter.d/vaultwarden.conf

diff --git a/config/filter.d/vaultwarden.conf b/config/filter.d/vaultwarden.conf
new file mode 100644
index 00000000..325395a6
--- /dev/null
+++ b/config/filter.d/vaultwarden.conf
@@ -0,0 +1,8 @@
+# Fail2Ban filter for unsuccessful Vaultwarden authentication attempts
+# Logged in /var/log/vaultwarden.log
+# Author: LearningSpot
+
+[Definition]
+
+failregex = \[vaultwarden::api::(identity||admin||core::two_factor::authenticator)\]\[ERROR\] (Invalid admin token||Invalid TOTP code||Username or password is incorrect)(.*) IP: <HOST>(?:\. Username: <F-USER>.+</F-USER>\.)?$
+ignoreregex =