mirror of
https://github.com/fail2ban/fail2ban.git
synced 2026-09-24 09:07:39 +00:00
3152afbdc2
e.g. Sep 25 12:51:04 myhost kernel: [773580.832329] sshd[25557]: Invalid user pgsql from 91.203.223.206 This fixes the sshd filter on Fedora 15, and probably other filters on other newish distros too.
47 lines
1.2 KiB
Text
47 lines
1.2 KiB
Text
# Generic configuration items (to be used as interpolations) in other
|
|
# filters or actions configurations
|
|
#
|
|
# Author: Yaroslav Halchenko
|
|
#
|
|
# $Revision$
|
|
#
|
|
|
|
[INCLUDES]
|
|
|
|
# Load customizations if any available
|
|
after = common.local
|
|
|
|
|
|
[DEFAULT]
|
|
|
|
# Daemon definition is to be specialized (if needed) in .conf file
|
|
_daemon = \S*
|
|
|
|
#
|
|
# Shortcuts for easier comprehension of the failregex
|
|
#
|
|
# PID.
|
|
# EXAMPLES: [123]
|
|
__pid_re = (?:\[\d+\])
|
|
|
|
# Daemon name (with optional source_file:line or whatever)
|
|
# EXAMPLES: pam_rhosts_auth, [sshd], pop(pam_unix)
|
|
__daemon_re = [\[\(]?%(_daemon)s(?:\(\S+\))?[\]\)]?:?
|
|
|
|
# Combinations of daemon name and PID
|
|
# EXAMPLES: sshd[31607], pop(pam_unix)[4920]
|
|
__daemon_combs_re = (?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:)
|
|
|
|
# Some messages have a kernel prefix with a timestamp
|
|
# EXAMPLES: kernel: [769570.846956]
|
|
__kernel_prefix = kernel: \[\d+\.\d+\]
|
|
|
|
__hostname = \S+
|
|
|
|
#
|
|
# Common line prefixes (beginnings) which could be used in filters
|
|
#
|
|
# [hostname] [vserver tag] daemon_id spaces
|
|
# this can be optional (for instance if we match named native log files)
|
|
__prefix_line = \s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s*
|
|
|