Package: fail2ban
Version: 0.8.0-2
Severity: normal
Tags: patch
filter.d/pure-ftpd.conf doesn't work if pure-ftpd has the LogPID option on. In
this case the logged lines look like:
May 25 20:52:47 gopher pure-ftpd[26108]: ([EMAIL PROTECTED]) [WARNING]
Authentication failed for user [TST001-test]
Here is a fix.
--- pure-ftpd.conf.~1~ Mon Mar 19 16:24:39 2007
+++ pure-ftpd.conf Fri May 25 16:59:24 2007
@@ -19,7 +19,7 @@
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
-failregex = pure-ftpd: (.+?@<HOST>) \[WARNING\] %(__errmsg)s \[.+\]$
+failregex = pure-ftpd(?:\[\d+\])?: (.+?@<HOST>) \[WARNING\] %(__errmsg)s
\[.+\]$
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
--
Roderick Schertler
[EMAIL PROTECTED]
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
