<div dir="ltr">Good catch...<div><br><div>I guess another thing to keep in mind is that this will only work with IPV4, not a huge issue currently... but it might pay to keep that in mind also.</div><div><br></div><div>in reality we could probably just use <span style="font-family:arial,sans-serif;font-size:13px">[\d+@\d+] or similar ...</span></div>
</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On 17 March 2014 17:00, Nandy Dagondon <span dir="ltr"><<a href="mailto:nandy1925@gmail.com" target="_blank">nandy1925@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Hi to all,</div><div><br></div><div>I just encountered an attack. I was wondering why fail2ban didn't catch it. The attacker used alphabetic user name. The regex detects numeric digits only. As a quick fix I modified the filter portion:</div>
<div> ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ Can't find user \[\d+@\d+\.\d+\.\d+\.\d+\] from <HOST>$</div><div><br></div><div>TO: ... Can't find user \[.+@\d+\.\d+\.\d+\.\d+\] from <HOST>$</div>
<div><br></div><div>to catch all characters.</div><div><br></div><div>Just sharing this.</div>
</div>
<br>_________________________________________________________________________<br>
Professional FreeSWITCH Consulting Services:<br>
<a href="mailto:consulting@freeswitch.org">consulting@freeswitch.org</a><br>
<a href="http://www.freeswitchsolutions.com" target="_blank">http://www.freeswitchsolutions.com</a><br>
<br>
FreeSWITCH-powered IP PBX: The CudaTel Communication Server<br>
<a href="http://www.cudatel.com" target="_blank">http://www.cudatel.com</a><br>
<br>
Official FreeSWITCH Sites<br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
<a href="http://wiki.freeswitch.org" target="_blank">http://wiki.freeswitch.org</a><br>
<a href="http://www.cluecon.com" target="_blank">http://www.cluecon.com</a><br>
<br>
FreeSWITCH-users mailing list<br>
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org">FreeSWITCH-users@lists.freeswitch.org</a><br>
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br>Sincerely<br><br>Jay
</div>