Differences

This shows you the differences between two versions of the page.

--- howto:fail2ban [2022/01/30 04:47] – Added new rule for clients consistently exceeding the maximum connection allowance Karloch
+++ howto:fail2ban [2025/08/18 14:15] (current) – Updated filter for hack.log, now matching all hack attempts, not just FTP Karloch
@@ Line 92: / Line 92: @@
 before = common.conf
 [Init]
-maxlines=6
+maxlines = 3
 [Definition]
-failregex = ^SUSPECTED FTP HACK ATTEMPT from .* on .* \nUsing port .* at .* \[<HOST>\]\nDetails: .* \n
+failregex = ^SUSPECTED .* LOGIN HACK ATTEMPT .*$(?:\r?\n)+Using port \S+ at .* \[(?:::ffff:)?<HOST>\]\s*$
+datepattern = {}(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) %%b %%d %%Y %%H:%%M:%%S
 ignoreregex =
 </code>
@@ Line 105: / Line 106: @@
 failregex = .* !TEMPORARY BAN of .* <HOST> .*
             SMTP BLACKLISTED SERVER on .* \(.*\)\: .* \[<HOST>\]
+            ^.*\[<HOST>\].*\!TEMPORARY BAN.*$
 ignoreregex =
 </code>