# Fail2Ban configuration file to block repeated failed login attempts to Frolor installation(s)
# 
# Froxlor needs to log to Syslog User (e.g. /var/log/user.log) with one of the following messages
# - for type=2
#     <syslog prefix> froxlor[1-6]: froxlor.WARNING: Unknown user tried to login. {"source":"login","action":"50","user":"<ADDR>"} []
#     <syslog prefix> froxlor[1-6]: froxlor.WARNING: User tried to login with wrong password. {"source":"login","action":"50","user":"<ADDR>"} []
# - for type=1:
#     <syslog prefix> Froxlor: [Login Action <ADDR>] Unknown user '<USER>' tried to login.
#     <syslog prefix> Froxlor: [Login Action <ADDR>] User '<USER>' tried to login with wrong password.
#
# Author: Joern Muehlencord
# Modified: Para-do-x™️ - Andreas Duennwald

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[DEFAULT]
_daemon = [Ff]roxlor

_re = (?:Unknown )?[uU]ser(?: '<F-USER>(?:\S*|[^']*)</F-USER>')? tried to login(?: with wrong password)?\.

[type1]
failregex = ^%(__prefix_line)s\[Login Action <ADDR>\] %(_re)s$

[type2]
failregex = ^%(__prefix_line)sfroxlor\.WARNING: %(_re)s \{(?:"[^"]+":"[^"]*",\s*){,5}"user":"<ADDR>"\} \[\]$

[Definition]
type = 2
failregex = <type<type>/failregex>
ignoreregex =