Update INSTALL.md

RNCTX commented

2020-09-13 14:37:23 +02:00

(Migrated from github.com)

Hello again, syslog format on Ubuntu does not match the INSTALL docs' fail2ban filter. I added four filters that will match, tested yesterday on a Ubuntu 20.04 installation with syslog logging enabled.

edit: whoops, copied/pasted the wrong lines to include the original ones, second commit is the proper one.

Hello again, syslog format on Ubuntu does not match the INSTALL docs' fail2ban filter. I added four filters that will match, tested yesterday on a Ubuntu 20.04 installation with syslog logging enabled. edit: whoops, copied/pasted the wrong lines to include the original ones, second commit is the proper one.

babelouest commented

2020-09-13 15:16:42 +02:00

(Migrated from github.com)

Thanks for the PR @RNCTX !

Although, I think you're missing some rules that were added recently. The current rules list is:

failregex = ^.* - Glewlwyd WARNING: Security - Authorization invalid for username .* at IP Address <HOST>
            ^.* - Glewlwyd WARNING: Security - Authorization invalid for client_id .* at IP Address <HOST>
            ^.* - Glewlwyd WARNING: Security - Code invalid at IP Address <HOST>
            ^.* - Glewlwyd WARNING: Security - Token invalid at IP Address <HOST>
            ^.* - Glewlwyd WARNING: Security - Scheme email - code sent for username .* at IP Address <HOST>
            ^.* - Glewlwyd WARNING: Security - Register new user - code sent to email .* at IP Address <HOST>
            ^.* - Glewlwyd WARNING: Security - Verify e-mail - code invalid at IP Address <HOST>
            ^.* - Glewlwyd WARNING: Security - Update e-mail - token sent to email .* at IP Address <HOST>
            ^.* - Glewlwyd WARNING: Security - Update e-mail - token invalid at IP Address <HOST>
            ^.* - Glewlwyd WARNING: Security - Reset credentials - token invalid at IP Address <HOST>
            ^.* - Glewlwyd WARNING: Security - Reset credentials - code invalid at IP Address <HOST>

Can you update your rules list with these new messages?

Also, I think a better way is to provide two different fail2ban rulesets, one for syslog and one for the log file/console.

Thanks for the PR @RNCTX ! Although, I think you're missing some rules that were added recently. The current rules list is: ``` failregex = ^.* - Glewlwyd WARNING: Security - Authorization invalid for username .* at IP Address <HOST> ^.* - Glewlwyd WARNING: Security - Authorization invalid for client_id .* at IP Address <HOST> ^.* - Glewlwyd WARNING: Security - Code invalid at IP Address <HOST> ^.* - Glewlwyd WARNING: Security - Token invalid at IP Address <HOST> ^.* - Glewlwyd WARNING: Security - Scheme email - code sent for username .* at IP Address <HOST> ^.* - Glewlwyd WARNING: Security - Register new user - code sent to email .* at IP Address <HOST> ^.* - Glewlwyd WARNING: Security - Verify e-mail - code invalid at IP Address <HOST> ^.* - Glewlwyd WARNING: Security - Update e-mail - token sent to email .* at IP Address <HOST> ^.* - Glewlwyd WARNING: Security - Update e-mail - token invalid at IP Address <HOST> ^.* - Glewlwyd WARNING: Security - Reset credentials - token invalid at IP Address <HOST> ^.* - Glewlwyd WARNING: Security - Reset credentials - code invalid at IP Address <HOST> ``` Can you update your rules list with these new messages? Also, I think a better way is to provide two different fail2ban rulesets, one for syslog and one for the log file/console.

RNCTX commented

2020-09-13 15:30:18 +02:00

(Migrated from github.com)

Hey, those are nice additions, you're right I haven't updated since I last sent a PR.

Just saw your last comment re: 2 different rulesets, changed to reflect those.

Hey, those are nice additions, you're right I haven't updated since I last sent a PR. Just saw your last comment re: 2 different rulesets, changed to reflect those.

babelouest commented

2020-09-13 20:22:00 +02:00

(Migrated from github.com)

I've made some little adjustments like removing doc/fail2ban/README.md duplication and pushed into master, thanks for the help @RNCTX !

👍 1

Rows
Columns

Update INSTALL.md #159