Updated regex in froxlor-auth.conf to match new logging format and modified logpath in jail.conf. Introduced keywords_to_remove option in abuseipdb action for improved reporting.
- Add `keywoards_to_remove` in abuseipdb action. This is an easy way to filter your reports. All keywords will be replaced with a `REDACTED` placeholder.
- As `actionban` is getting long, spread it over new lines to increase readability.
Will solve #3428
Sorry for duplicate, removed repo too early.
Before submitting your PR, please review the following checklist:
- [ ] **CONSIDER adding a unit test** if your PR resolves an issue
- [X] **LIST ISSUES** this PR resolves or describe the approach in detail
- [X] **MAKE SURE** this PR doesn't break existing tests
- [X] **KEEP PR small** so it could be easily reviewed
- [X] **AVOID** making unnecessary stylistic changes in unrelated code
- [ ] **ACCOMPANY** each new `failregex` for filter `X` with sample log lines
(and `# failJSON`) within `fail2ban/tests/files/logs/X` file
- [X] **PROVIDE ChangeLog** entry describing the pull request
```
Introduce `keywords_to_remove` option in `abuseipdb` action to improve reporting with filtering out important information
```
The current regex doesn't match the following log entry, seen with
Postfix 3.10.2:
Sep 17 18:19:20 mxhost postfix/smtpd[12345]: NOQUEUE: lost connection after CONNECT from unknown[192.0.2.25]
Sep 17 18:19:20 mxhost postfix/smtpd[12345]: disconnect from unknown[192.0.2.25] commands=0/0
- with `prefregex` to capture content of error only (bypass common prefix and suffix, like server, request, host, referrer);
- to match PAM authentication failures (gh-4071)
In test case testReadStockJailFilterComplete, set configuration
directory to CONFIG_DIR (/etc/fail2ban/filter.d on the target) instead
of the hardcoded "config" directory. Otherwise, the config files will
not be found during runtime testing.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
- new variant for `no auth attempts in X secs` with `Login aborted` and `(no_auth_attempts)`;
- covered `disconnected during TLS handshake` with `no application protocol` and `no shared cipher`.
- new variant for `no auth attempts in X secs` with `Login aborted` and `(no_auth_attempts)`;
- covered `disconnected during TLS handshake` with `no application protocol` and `no shared cipher`.
relative paths are based relative the working dir;
to use it relative current config root (normally `/etc/fail2ban`), one can use interpolation `%(fail2ban_confpath)s`, e.g.:
file://%(fail2ban_confpath)s/ignore-ipaddr-file
