[Freeswitch-users] Fail2Ban filter

[Nandy Dagondon]

Hi to all,

I just encountered an attack. I was wondering why fail2ban didn't catch it.
 The attacker used alphabetic user name. The regex detects numeric digits
only.  As a quick fix I modified the filter portion:
            ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ Can't find user
\[\d+@\d+\.\d+\.\d+\.\d+\]
from <HOST>$

TO: ...  Can't find user \[.+@\d+\.\d+\.\d+\.\d+\] from <HOST>$

to catch all characters.

Just sharing this.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20140317/134e81e0/attachment.html