Edit file

File name : ejabberd-auth.conf

Content :# Fail2Ban configuration file # # Author: Steven Hiscocks # # [Definition] # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "<HOST>" can # be used for standard IP/hostname matching and is only an alias for # (?:::f{4,6}:)?(?P<host>[\w\-.^_]+) # Multiline regexs should use tag "<SKIPLINES>" to separate lines. # This allows lines between the matching lines to continue to be # searched for other failures. This tag can be used multiple times. # Values: TEXT # failregex = ^=INFO REPORT==== ===\nI\(<0\.\d+\.0>:ejabberd_c2s:\d+\) : \([^)]+\) Failed authentication for \S+ from (?:IP )?<HOST>(?: \({{(?:\d+,){3}\d+},\d+}\))?$ ^(?:\.\d+)? \[info\] <0\.\d+\.\d>@ejabberd_c2s:\w+:\d+ \([^\)]+\) Failed (?:c2s \w+ )?authentication for \S+ from (?:IP )?(?:::FFFF:)?<HOST>(?:: |$) # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # ignoreregex = # "maxlines" is number of log lines to buffer for multi-line regex searches maxlines = 2 # Option: journalmatch # Notes.: systemd journalctl style match filter for journal based backend # Values: TEXT # journalmatch = #datepattern = ^(?:=[^=]+={3,} )?({DATE}) # explicit time format using prefix =...==== and no date in second string begins with I(...)... datepattern = ^(?:=[^=]+={3,} )?(%%ExY(?P<_sep>[-/.])%%m(?P=_sep)%%d[T ]%%H:%%M:%%S(?:[.,]%%f)?(?:\s*%%z)?) ^I\(()**

Save