You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Systemd (long may it and its developer burn in hell) has come along and replaced all the sane and logical system-logging solutions we all used to love and adore. With that now being a fait accompli, we are all suffering as we try and learn how to use the incomprehensible behemoth that is systemd.
It would be nice/convenient/useful to have two options available for the provided wordpress.jail configuration file, one for wise systems that still use syslog-ng/rsyslog/etc, and one for the now more brain-dead systems with systemd. (Yes, I loath systemd with a fiery burning passion)
So far I've been able to adjust the jail config file to recognise the systemd backend, but have not been able to write and test the journalmatch entry to catch the php-generated auth messages from this plugin.
This seems to be a mostly-functional method of re-discovering /var/log/auth.log :
and from my brief poking at it with grep, it looks like we only need facility=4.
I've managed to get this far:
/etc/fail2ban/jail.d/wordpress.conf
backend = systemd
journalmatch = _SYSLOG_FACILITY=4
The provided filters (soft and hard) do catch authentication failures - yay! but I've not yet found a way to wrap this information into something I can properly test with fail2ban-regex. I could just wait and see if these users turn up in the jails, but I'd like a more concrete way of validating the config. The doco for 'fail2ban-regex systemd-journal' is again, abyss-like in its absence.
I'm seeing singular authentication attempts from IP addresses, but not multiple attempts, so they've possibly not met the jailing requirements yet.
I'm hoping that you've been able to install and configure this module within a systemd-disabled system, and thus can share your working configuration files?
The text was updated successfully, but these errors were encountered:
Systemd (long may it and its developer burn in hell) has come along and replaced all the sane and logical system-logging solutions we all used to love and adore. With that now being a fait accompli, we are all suffering as we try and learn how to use the incomprehensible behemoth that is systemd.
It would be nice/convenient/useful to have two options available for the provided wordpress.jail configuration file, one for wise systems that still use syslog-ng/rsyslog/etc, and one for the now more brain-dead systems with systemd. (Yes, I loath systemd with a fiery burning passion)
So far I've been able to adjust the jail config file to recognise the systemd backend, but have not been able to write and test the journalmatch entry to catch the php-generated auth messages from this plugin.
This seems to be a mostly-functional method of re-discovering /var/log/auth.log :
and from my brief poking at it with grep, it looks like we only need facility=4.
I've managed to get this far:
/etc/fail2ban/jail.d/wordpress.conf
backend = systemd
journalmatch = _SYSLOG_FACILITY=4
The provided filters (soft and hard) do catch authentication failures - yay! but I've not yet found a way to wrap this information into something I can properly test with fail2ban-regex. I could just wait and see if these users turn up in the jails, but I'd like a more concrete way of validating the config. The doco for 'fail2ban-regex systemd-journal' is again, abyss-like in its absence.
I'm seeing singular authentication attempts from IP addresses, but not multiple attempts, so they've possibly not met the jailing requirements yet.
I'm hoping that you've been able to install and configure this module within a systemd-disabled system, and thus can share your working configuration files?
The text was updated successfully, but these errors were encountered: