<div dir="ltr"><div>Hi to all,</div><div><br></div><div>I just encountered an attack. I was wondering why fail2ban didn't catch it. The attacker used alphabetic user name. The regex detects numeric digits only. As a quick fix I modified the filter portion:</div>
<div> ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ Can't find user \[\d+@\d+\.\d+\.\d+\.\d+\] from <HOST>$</div><div><br></div><div>TO: ... Can't find user \[.+@\d+\.\d+\.\d+\.\d+\] from <HOST>$</div>
<div><br></div><div>to catch all characters.</div><div><br></div><div>Just sharing this.</div>
</div>