Hello, I would like to use a Fail2Ban filter for the cPanel login_log (/usr/local/cpanel/logs). Unfortunately I am not experienced with these filters. I can't figure out a working regex for webmaild. I would like to filter rules like these: [2017-12-26 20:59:45 +0100] info [webmaild] 123.123.123.123 - test2@domain.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist) [2017-12-26 21:00:59 +0100] info [webmaild] 123.123.123.123 - test1@domain.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect I am not sure how to write the required failregex lines. I am hoping some could kindly help me, please.
You might like to consider CSF/LFD that has a built in rule for login failure detection of cpanel, webmail and whm connections. More details at : How to Configure Your Firewall for cPanel Services - cPanel Knowledge Base - cPanel Documentation
Hello, I concur with @rpvw. CSF is likely the best approach if you'd like to avoid writing custom rules. Thank you.
Many thanks as this is very helpful. I am surprised that CSF works out of the box (although I have changed some things).
