fail2ban: fix regex for NC18

nextcloud · Feb 12, 2020 · c0cee6b · c0cee6b
1 parent 0c538ae
commit c0cee6b
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/bin/ncp/SECURITY/fail2ban.sh b/bin/ncp/SECURITY/fail2ban.sh
@@ -98,7 +98,9 @@ configure()
 before = common.conf
 
 [Definition]
-failregex = Login failed.*Remote IP.*<HOST>
+_groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)
+failregex = ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
+datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"
 ignoreregex =
 EOF