Hello,
I would like to use a Fail2Ban filter for the cPanel login_log (/usr/local/cpanel/logs).
Unfortunately I am not experienced with these filters. I can't figure out a working regex for webmaild.
I would like to filter rules like these:
[2017-12-26 20:59:45 +0100] info [webmaild] 123.123.123.123 - [email protected] "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)
[2017-12-26 21:00:59 +0100] info [webmaild] 123.123.123.123 - [email protected] "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect
I am not sure how to write the required failregex lines. I am hoping some could kindly help me, please.
I would like to use a Fail2Ban filter for the cPanel login_log (/usr/local/cpanel/logs).
Unfortunately I am not experienced with these filters. I can't figure out a working regex for webmaild.
I would like to filter rules like these:
[2017-12-26 20:59:45 +0100] info [webmaild] 123.123.123.123 - [email protected] "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)
[2017-12-26 21:00:59 +0100] info [webmaild] 123.123.123.123 - [email protected] "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect
I am not sure how to write the required failregex lines. I am hoping some could kindly help me, please.