fail2ban-confs/filter.d/nextcloud-auth.conf
2022-08-06 17:02:04 -05:00

15 lines
435 B
Plaintext

## Version 2022/08/06
# Fail2Ban filter configuration for nextcloud
[INCLUDES]
before = common.conf
[Definition]
_groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)
failregex = ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Trusted domain error.
datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"