fail2ban.log.1

gistfile1.txt

fail2ban-regex test on my failed login's ssh log snippet:


Running tests
=============

Use regex file : /etc/fail2ban/filter.d/sshd.conf
Use log file   : fake.log


Results
=======

Failregex
|- Regular expressions:
|  [1] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
|  [2] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
|  [3] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*Failed (?:password|publickey) for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
|  [4] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*ROOT LOGIN REFUSED.* FROM <HOST>\s*$
|  [5] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*[iI](?:llegal|nvalid) user .* from <HOST>\s*$
|  [6] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*User .+ from <HOST> not allowed because not listed in AllowUsers$
|  [7] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*authentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
|  [8] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*refused connect from \S+ \(<HOST>\)\s*$
|  [9] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*Address <HOST> .* POSSIBLE BREAK-IN ATTEMPT!*\s*$
|  [10] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*User .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$
|
`- Number of matches:
   [1] 0 match(es)
   [2] 0 match(es)
   [3] 9 match(es)
   [4] 0 match(es)
   [5] 3 match(es)
   [6] 0 match(es)
   [7] 0 match(es)
   [8] 0 match(es)
   [9] 0 match(es)
   [10] 0 match(es)

Ignoreregex
|- Regular expressions:
|
`- Number of matches:

Summary
=======

Addresses found:
[1]
[2]
[3]
    94.132.30.101 (Thu Jul 05 11:58:20 2012)
    94.132.30.101 (Thu Jul 05 11:58:24 2012)
    94.132.30.101 (Thu Jul 05 11:58:27 2012)
    94.132.30.101 (Thu Jul 05 11:58:32 2012)
    94.132.30.101 (Thu Jul 05 11:58:36 2012)
    94.132.30.101 (Thu Jul 05 11:58:38 2012)
    94.132.30.101 (Thu Jul 05 11:58:44 2012)
    94.132.30.101 (Thu Jul 05 11:58:47 2012)
    94.132.30.101 (Thu Jul 05 11:58:51 2012)
[4]
[5]
    94.132.30.101 (Thu Jul 05 11:58:16 2012)
    94.132.30.101 (Thu Jul 05 11:58:28 2012)
    94.132.30.101 (Thu Jul 05 11:58:41 2012)
[6]
[7]
[8]
[9]
[10]

Date template hits:
432 hit(s): MONTH Day Hour:Minute:Second
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second Year
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second
0 hit(s): Year/Month/Day Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/MONTH/Year:Hour:Minute:Second
0 hit(s): Month/Day/Year:Hour:Minute:Second
0 hit(s): Year-Month-Day Hour:Minute:Second
0 hit(s): Year.Month.Day Hour:Minute:Second
0 hit(s): Day-MONTH-Year Hour:Minute:Second[.Millisecond]
0 hit(s): Day-Month-Year Hour:Minute:Second
0 hit(s): TAI64N
0 hit(s): Epoch
0 hit(s): ISO 8601
0 hit(s): Hour:Minute:Second
0 hit(s): <Month/Day/Year@Hour:Minute:Second>

Success, the total number of match is 12

However, look at the above section 'Running tests' which could contain important
information.


2013-06-23 06:45:56,762 fail2ban.server : INFO   Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.6
2013-06-23 06:45:57,242 fail2ban.filter : INFO   Log rotation detected for /var/log/apache2/error.log
2013-06-23 06:45:57,243 fail2ban.filter : INFO   Log rotation detected for /var/log/apache2/error.log
2013-06-23 06:45:57,329 fail2ban.filter : INFO   Log rotation detected for /var/log/apache2/error.log
2013-06-23 06:45:58,178 fail2ban.filter : INFO   Log rotation detected for /var/log/auth.log
2013-06-23 06:46:01,181 fail2ban.filter : INFO   Log rotation detected for /var/log/auth.log
2013-06-27 14:58:38,212 fail2ban.actions: WARNING [apache-noscript] Ban 188.102.55.132
2013-06-27 15:58:39,456 fail2ban.actions: WARNING [apache-noscript] Unban 188.102.55.132
2013-06-30 06:35:09,707 fail2ban.filter : INFO   Log rotation detected for /var/log/apache2/error.log
2013-06-30 06:35:10,204 fail2ban.filter : INFO   Log rotation detected for /var/log/apache2/error.log
2013-06-30 06:35:10,278 fail2ban.filter : INFO   Log rotation detected for /var/log/apache2/error.log



current restart:

2013-07-05 10:23:10,889 fail2ban.jail   : INFO   Creating new jail 'ssh'
2013-07-05 10:23:10,889 fail2ban.jail   : INFO   Jail 'ssh' uses poller
2013-07-05 10:23:10,904 fail2ban.filter : INFO   Added logfile = /var/log/auth.log
2013-07-05 10:23:10,905 fail2ban.filter : INFO   Set maxRetry = 6
2013-07-05 10:23:10,906 fail2ban.filter : INFO   Set findtime = 600
2013-07-05 10:23:10,907 fail2ban.actions: INFO   Set banTime = 3601