diff --git a/config/filter.d/mysqld.conf b/config/filter.d/mysqld.conf index bc9164ce..197c8232 100644 --- a/config/filter.d/mysqld.conf +++ b/config/filter.d/mysqld.conf @@ -1,8 +1,7 @@ -# Fail2Ban configuration file +# Fail2Ban configuration file for unsuccesfull MySQL authentication attempts # -# Author: Artur Penttinen -# -# $Revision$ +# Authors: Artur Penttinen +# Yaroslav O. Halchenko # [INCLUDES] @@ -23,7 +22,7 @@ before = common.conf # (?:::f{4,6}:)?(?P[\w\-.^_]+) # Values: TEXT # 130322 11:26:54 [Warning] Access denied for user 'root'@'127.0.0.1' (using password: YES) -failregex = Access denied for user '\w+'@'' +failregex = Access denied for user '\w+'@'' (to database '[^']*'|\(using password: (YES|NO)\))*\s*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/testcases/files/logs/mysqld.log b/testcases/files/logs/mysqld.log index 8dfd6338..b3a73078 100644 --- a/testcases/files/logs/mysqld.log +++ b/testcases/files/logs/mysqld.log @@ -1,17 +1,6 @@ -130323 21:14:28 [Warning] Access denied for user 'root'@'192.168.1.34' (using password: NO) 130324 0:04:00 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: NO) -130324 0:04:02 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES) -130324 0:04:05 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES) -130324 0:04:07 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES) -130324 0:04:09 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES) -130324 0:04:11 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES) -130324 0:04:13 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES) -130324 0:04:16 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES) -130324 0:04:18 [Warning] Access denied for user 'root'@'192.168.1.35' (using password: YES) 130324 8:24:09 [Warning] Access denied for user 'root'@'220.95.238.171' (using password: NO) 130324 17:56:13 [Warning] Access denied for user 'root'@'61.160.223.112' (using password: NO) 130324 17:56:14 [Warning] Access denied for user 'root'@'61.160.223.112' (using password: YES) -130324 17:56:15 [Warning] Access denied for user 'root'@'61.160.223.112' (using password: YES) 130324 19:01:39 [Warning] Access denied for user 'root'@'61.147.108.35' (using password: NO) 130324 19:01:40 [Warning] Access denied for user 'root'@'61.147.108.35' (using password: YES) -130324 19:01:41 [Warning] Access denied for user 'root'@'61.147.108.35' (using password: YES)