1 Nov
2019
1 Nov
'19
5:13 p.m.
El vie., 1 nov. 2019 a las 19:20, Ralph Corderoy (<ralph@inputplus.co.uk>) escribió:
Hi Maykel,
I don't use fail2ban, but I've just skimmed https://fail2ban.readthedocs.io/en/latest/filters.html#developing-filter-reg... You may find the ‘debuggex’ reference useful.
failregex = Unknown User .* \(<HOST>:.*\) ... [12:48:35.315] Server1: Unknown User 'test' (109.103.148.2) ... Date template hits: |- [# of hits] date format | [6] {^LN-BEG}24hour:Minute:Second
I take that to mean it was happy with the timestamp.
failregex = Unknown User .* \(<HOST>:.*\)
How about
failregex = ^\S+: Unknown User .* \(<HOST>\)$
-- Cheers, Ralph.
Thanks for your help but not working... https://imgur.com/a/w0F2JSC