From a7ebb84a7d9746d2a6d5681871e873b2ecb8f26c Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Mon, 26 Aug 2013 08:42:45 +1000 Subject: [PATCH 1/2] ENH: tighted up lighttpd regex --- config/filter.d/lighttpd-auth.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/lighttpd-auth.conf b/config/filter.d/lighttpd-auth.conf index b89c5d96..375b26bd 100644 --- a/config/filter.d/lighttpd-auth.conf +++ b/config/filter.d/lighttpd-auth.conf @@ -9,7 +9,7 @@ # Notes.: regex to match wrong passwords as notified by lighttpd's auth Module # Values: TEXT # -failregex = .*http_auth.*(password doesn\'t match|wrong password|get_password failed).*IP: \s*$ +failregex = ^: \(http_auth\.c\.\d+\) (password doesn\'t match|digest: auth failed for .*: wrong password|get_password failed).*, IP: \s*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. From b8e7d0b867f1542fda44e13a4a11a92627fc2838 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Mon, 26 Aug 2013 08:51:40 +1000 Subject: [PATCH 2/2] ENH: further tighten lighttpd basic auth regex --- config/filter.d/lighttpd-auth.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/lighttpd-auth.conf b/config/filter.d/lighttpd-auth.conf index 375b26bd..b59a98a2 100644 --- a/config/filter.d/lighttpd-auth.conf +++ b/config/filter.d/lighttpd-auth.conf @@ -9,7 +9,7 @@ # Notes.: regex to match wrong passwords as notified by lighttpd's auth Module # Values: TEXT # -failregex = ^: \(http_auth\.c\.\d+\) (password doesn\'t match|digest: auth failed for .*: wrong password|get_password failed).*, IP: \s*$ +failregex = ^: \(http_auth\.c\.\d+\) (password doesn\'t match .* username: .*|digest: auth failed for .*: wrong password|get_password failed), IP: \s*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored.