17 Mar
2014
17 Mar
'14
7 a.m.
Hi to all, I just encountered an attack. I was wondering why fail2ban didn't catch it. The attacker used alphabetic user name. The regex detects numeric digits only. As a quick fix I modified the filter portion: ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ Can't find user \[\d+@\d+\.\d+\.\d+\.\d+\] from <HOST>$ TO: ... Can't find user \[.+@\d+\.\d+\.\d+\.\d+\] from <HOST>$ to catch all characters. Just sharing this.