From 244a96f9b3fb58867f073957714cf4d464cde80a Mon Sep 17 00:00:00 2001 From: Terence Namusonge Date: Sat, 25 May 2013 19:26:13 +0200 Subject: [PATCH 1/2] fixed failregex line for roundcube 0.9+ # Only works only if log driver: is set to 'syslog'. this is becoz fail2ban fails to 'read' the line due to the brackets around the date timestamp on logline when log driver is set to file --- config/filter.d/roundcube-auth.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/filter.d/roundcube-auth.conf b/config/filter.d/roundcube-auth.conf index 41766e31..7b153f44 100644 --- a/config/filter.d/roundcube-auth.conf +++ b/config/filter.d/roundcube-auth.conf @@ -1,6 +1,6 @@ # Fail2Ban configuration file for roundcube web server # -# Author: Teodor Micu & Yaroslav Halchenko +# Author: Teodor Micu & Yaroslav Halchenko & terence namusonge # # @@ -13,7 +13,7 @@ # (?:::f{4,6}:)?(?P[\w\-.^_]+) # Values: TEXT # -failregex = FAILED login for .*. from \s*$ +failregex = (FAILED login|Login failed) for .* from \s*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. From 098c88a67b8db83beaac6d9820e20ee109e3e6d0 Mon Sep 17 00:00:00 2001 From: Terence Namusonge Date: Sun, 26 May 2013 07:46:29 +0200 Subject: [PATCH 2/2] failregex when roundcube log driver is set to 'syslog' --- testcases/files/logs/roundcube-auth | 1 + 1 file changed, 1 insertion(+) diff --git a/testcases/files/logs/roundcube-auth b/testcases/files/logs/roundcube-auth index d16f7266..04e0faf5 100644 --- a/testcases/files/logs/roundcube-auth +++ b/testcases/files/logs/roundcube-auth @@ -1 +1,2 @@ [22-Jan-2013 22:28:21 +0200]: FAILED login for user1 from 192.0.43.10 +May 26 07:12:40 hamster roundcube: IMAP Error: Login failed for sales@example.com from 10.1.1.47