From owner-freebsd-questions@freebsd.org Sat Jul 23 21:07:02 2016 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id B1C1ABA2314 for ; Sat, 23 Jul 2016 21:07:02 +0000 (UTC) (envelope-from pathiaki2@yahoo.com) Received: from nm13-vm0.bullet.mail.bf1.yahoo.com (nm13-vm0.bullet.mail.bf1.yahoo.com [98.139.213.79]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 6C3071F49 for ; Sat, 23 Jul 2016 21:07:01 +0000 (UTC) (envelope-from pathiaki2@yahoo.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1469308015; bh=Aixdcautth6/hRKA3j1ddb29zRnYpv640ly9uFT6sr8=; h=To:From:Subject:Date:From:Subject; b=Ik/NMJI67BphUvpGuizvr6wPbMvL3gWLNKZl5wDZVP4hgTamkk7HVBANvQWrMsvEctKJgh4me8cGCT6IK9/LsRjpdmOPHY1fbqyL/r8uQCFYoA6MHdpl8cS0BY3jIqkIRS+PIawYxxTW3snx9cDHZSit8bqs7SuN4lMHL5ACUPLs3pcN8fwruQG6dIGrnmAKqw75iYntZpb2a+4Hw+PoKbz3nrW4yECfHQPhCcbWfYBDNbTWfetZIABJfo8oKRB95a3hNLduLuYk4WrUQCgpxQepJUwbRUDY9cImsuF9110Cjkg0HcbGMZ+Wfb/j9hkV/Zln0Fz0tAuHUewpj8mzVA== Received: from [66.196.81.171] by nm13.bullet.mail.bf1.yahoo.com with NNFMP; 23 Jul 2016 21:06:55 -0000 Received: from [98.139.211.199] by tm17.bullet.mail.bf1.yahoo.com with NNFMP; 23 Jul 2016 21:06:55 -0000 Received: from [127.0.0.1] by smtp208.mail.bf1.yahoo.com with NNFMP; 23 Jul 2016 21:06:55 -0000 X-Yahoo-Newman-Id: 479111.26234.bm@smtp208.mail.bf1.yahoo.com X-Yahoo-Newman-Property: ymail-3 X-YMail-OSG: EkdKu.wVM1lywt0ieopP6WutUyjMtxUUP6l6KjQeKwqBDOH Ih9NumHAf5kn93KRqlZ8vTqxl2goTt7N5k.Dt2ShXOdYSmVHmXJs_FiCqolI rylHAXG.6yrTtg4xMrFCyCOm6wZ09lqeGgKZazRaduBQ3I7FhrJQB8sS6WLr J9KFtzFtxbxmfaDIT4FVTWVEMuOvV4Evb.cxMIBnj3E6fpMBcGtUfUqt35ze 1CHCrBtZKo5X25HrMQOsooKG8OPMnxtVaLYvnMG.8SiefJs6o2bpsxRnbjMg v0W2CvAR8Xirq.87zuxId1tNNlt8qPmKPMK8g.s5m2R7ahLi.cu0MkHhdwgl b3.o7FKB.Vs711I9BrAwiVW1jmSJ5KOgrznzNxrv8yyIwS3zfsrfoeQSzLfp OTlnfA6IS5pA0TThPnF7WPS6CnH0FN.6XRmqlvEGxJ.dSDt7ImpnxTO0PQCz d8TnDbctmWgqrERZn9vHQdfWduz3f39UjccILM_W4SsjqaqjPiiERY7iBPs9 Y4pmtfgwaAsYXdht1Mw4iJc3vYZPbZW1XJRlokKmmpnhlXDjAoOc- X-Yahoo-SMTP: h3Xqg6.swBC0yI913RMMwp94grO_cg-- To: freebsd-questions@freebsd.org From: pathiaki2 Subject: Fail2ban python regex issue Message-ID: <1b35e652-1540-6eb3-9a6e-47a0cf4ce97a@yahoo.com> Date: Sat, 23 Jul 2016 17:06:53 -0400 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Jul 2016 21:07:02 -0000 Hi, I'm extending fail2ban to catch things on FreeBSD. Right now I'm looking at dovecot. This is the standard file. # Fail2Ban filter Dovecot authentication and pop3/imap server # [INCLUDES] before = common.conf [Definition] _daemon = (auth|dovecot(-auth)?|auth-worker) failregex = ^%(__prefix_line)s(%(__pam_auth)s(\(dovecot:auth\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=(\s+user=\S*)?\s*$ ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((auth failed, \d+ attempts)( in \d+ secs)?|tried to use (disabled|disallowed) \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=(, lip=(\d{1,3}\.){3}\d{1,3})?(, TLS( handshaking(: SSL_accept\(\) failed: error:[\dA-F]+:SSL routines:[TLS\d]+_GET_CLIENT_HELLO:unknown protocol)?)?(: Disconnected)?)?(, session=<\S+>)?\s*$ ^%(__prefix_line)s(Info|dovecot: auth\(default\)|auth-worker\(\d+\)): pam\(\S+,\): pam_authenticate\(\) failed: (User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \(password mismatch\?\))\s*$ ^%(__prefix_line)s(auth|auth-worker\(\d+\)): (pam|passwd-file)\(\S+,\): unknown user\s*$ ^%(__prefix_line)s(auth|auth-worker\(\d+\)): Info: ldap\(\S*,,\S*\): invalid credentials\s*$ ignoreregex = [Init] journalmatch = _SYSTEMD_UNIT=dovecot.service I have a line I want to match. However, every python interpreter that I hit says this works.... However, fail2ban doesn't catch the line. The line: Jul 23 00:02:48 dovecot: auth: ldap(valeria,91.200.12.148): unknown user (SHA1 of given password: e557ee1b78fd6978af5ea1f614597f79dc13c40e) I'm trying this: ^%(__prefix_line)s(: auth: ldap\(\S+,\):) unknown user\s*$ What am I missing? There's no error with the interpreter, it's just not matching the line.