Sziasztok
ha ezt beírom a parancssorba akkor kiadja az eredményeket
fail2ban-regex /var/log/mail.log "reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 Client host rejected:"
Running tests
=============
Use regex line : reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 Clien...
Use log file : /var/log/mail.log
Results
=======
Failregex
|- Regular expressions:
| [1] reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 Client host rejected:
|
`- Number of matches:
[1] 245 match(es)
Ignoreregex
|- Regular expressions:
|
`- Number of matches:
Summary
=======
Addresses found:
[1]
213.142.148.150 (Sun Nov 24 06:29:39 2019)
...
41.228.74.129 (Mon Nov 25 16:05:55 2019)
Date template hits:
16986 hit(s): MONTH Day Hour:Minute:Second
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second Year
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second
0 hit(s): Year/Month/Day Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/MONTH/Year:Hour:Minute:Second
0 hit(s): Month/Day/Year:Hour:Minute:Second
0 hit(s): Year-Month-Day Hour:Minute:Second
0 hit(s): Year.Month.Day Hour:Minute:Second
0 hit(s): Day-MONTH-Year Hour:Minute:Second[.Millisecond]
0 hit(s): Day-Month-Year Hour:Minute:Second
0 hit(s): TAI64N
0 hit(s): Epoch
0 hit(s): ISO 8601
0 hit(s): Hour:Minute:Second
0 hit(s): <Month/Day/Year@Hour:Minute:Second>
Success, the total number of match is 245
However, look at the above section 'Running tests' which could contain important
information.
Ha hasonlót építek be egy conf fájlba:
# Fail2Ban configuration file
#
# Author: Cyril Jaquier
#
# $Revision$
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf
[Definition]
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values: TEXT
#
_daemon = postfix/smtpd
#NOQUEUE: reject: RCPT from unknown[213.142.148.190]: 450 4.7.1 Client host rejected:
failregex = ^%(__prefix_line)sreject: RCPT from \S+\[<HOST>\]$
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
és lefuttatom ezt:
fail2ban-regex /var/log/mail.log /etc/fail2ban/filter.d/postfix.conf
akkor ezt kapom:
Running tests
=============
Use regex file : /etc/fail2ban/filter.d/postfix.conf
Use log file : /var/log/mail.log
Results
=======
Failregex
|- Regular expressions:
| [1] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?postfix/smtpd(?:\(\S+\))?[\]\)]?:?|[\[\(]?postfix/smtpd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*reject: RCPT from \S+\[<HOST>\]$
|
`- Number of matches:
[1] 0 match(es)
Ignoreregex
|- Regular expressions:
|
`- Number of matches:
Summary
=======
Sorry, no match
Look at the above section 'Running tests' which could contain important
information.
Mitől nem szerepel a "kevesebb/gyengébb" regexp mint ha csak úgy írom be a parancssorba?