Fail2Ban正则表达式不匹配
Fail2Ban正则表达式不匹配
提问于 2014-04-20 15:09:06
我在用fail2ban。出于某种原因，Fail2Ban拒绝编译我的正则表达式。这是我需要匹配的日志：
root@server1:/etc/fail2ban/filter.d# tail /var/log/apache2/error.log
[Sun Apr 20 10:40:05 2014] [error] [client 75.144.181.151] user root: authentication failure for "/phpmyadmin/": Password Mismatch
[Sun Apr 20 10:40:16 2014] [error] [client 75.144.181.151] user root: authentication failure for "/phpmyadmin/": Password Mismatch
[Sun Apr 20 10:40:38 2014] [error] [client 75.144.181.151] user haker not found: /phpmyadmin/
[Sun Apr 20 10:40:44 2014] [error] [client 75.144.181.151] user pentest not found: /phpmyadmin/下面是我的fail2ban filter.d文件：
root@server1:/etc/fail2ban/filter.d# cat /etc/fail2ban/filter.d/phpmyadmin.conf
[Definition]
failregex = [client <HOST>;] user .*; not found: \/phpmyadmin\/|[client <HOST>;] user root: authentication failure for "\/phpmyadmin\/":
ignoreregex =下面是上面文件中的regex行：
[client <HOST>;] user .*; not found: \/phpmyadmin\/|[client <HOST>;] user root: authentication failure for "\/phpmyadmin\/":不幸的是，fail2ban日志文件给了我关于regex：无法编译正则表达式..的错误
root@server1:/etc/fail2ban# tail /var/log/fail2ban.log
2014-04-20 10:47:06,788 fail2ban.filter : INFO Added logfile = /var/log/apache2/error.log
2014-04-20 10:47:06,789 fail2ban.filter : INFO Set maxRetry = 3
2014-04-20 10:47:06,789 fail2ban.filter : INFO Set findtime = 600
2014-04-20 10:47:06,790 fail2ban.actions: INFO Set banTime = 600
2014-04-20 10:47:06,790 fail2ban.filter : ERROR Unable to compile regular expression '[client (?:::f{4,6}:)?(?P<host>[\w\-.^_]+);] user .*; not found: \/phpmyadmin\/|[client (?:::f{4,6}:)?(?P<host>[\w\-.^_]+);] user root: authentication failure for "\/phpmyadmin\/":'
2014-04-20 10:47:06,794 fail2ban.jail : INFO Jail 'ssh' started
2014-04-20 10:47:06,799 fail2ban.jail : INFO Jail 'pureftpd' started
2014-04-20 10:47:06,805 fail2ban.jail : INFO Jail 'phpmyadmin' started我的regex http://regex101.com/r/kU7tX3。这是怎么回事？任何帮助都是非常感谢的。谢谢。
回答 1
Stack Overflow用户
发布于 2014-04-20 15:31:42
我本想在评论中提出一个问题，但我不能补充评论：
所以尽我最大的努力去理解这个要求并给出一个答案。
要求:我认为您正在筛选包含“身份验证失败"/phpmyadmin/"”的所有行
您可以通过将正则表达式更改为：
failregex = .*authentication failure for "\/phpmyadmin\/"你可能得逃走“
如果这不是正确的理解，请补充意见.
页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://stackoverflow.com/questions/23183973
复制相关文章
相似问题
腾讯云开发者
