Differences

This shows you the differences between two versions of the page.

--- howto:fail2ban [2023/07/25 15:36] – [Use Fail2Ban on GNU/Linux to block botnet's attacks] nick young
+++ howto:fail2ban [2025/08/18 14:15] (current) – Updated filter for hack.log, now matching all hack attempts, not just FTP Karloch
@@ Line 92: / Line 92: @@
 before = common.conf
 [Init]
-maxlines=6
+maxlines = 3
 [Definition]
-failregex = ^SUSPECTED FTP HACK ATTEMPT from .* on .* \nUsing port .* at .* \[<HOST>\]\nDetails: .* \n
+failregex = ^SUSPECTED .* LOGIN HACK ATTEMPT .*$(?:\r?\n)+Using port \S+ at .* \[(?:::ffff:)?<HOST>\]\s*$
+datepattern = {}(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) %%b %%d %%Y %%H:%%M:%%S
 ignoreregex =
 </code>