Fail2ban and OC 10

[ruuskil]

Hi.

I've been using fail2ban since version 8x to harden my server. Now after upgrading to version 10 my f2b has stopped working. My understanding is there has been some change in owncloud logging syntax in OC 10. Can someone tell me how to change my f2b configuration so it understands OC10?

My current .conf for fail2ban is like this

failregex={"reqId":".","remoteAddr":"","app":"core","message":"Login failed: .","level":2,"time":".*"}

How should I change it?

[anon81984126]

Your failregex is not quite correct from what i can see and doesn't match the ones for 8.x and 9.x provided at [1]. In oC 10.0 only the order of the entries changed [2], [3] so it should be easy to apply those changes to the failregex listed at [1] and just re-order the failregex to match the new syntax / order.

[1]

Fail2ban and ownCloud 8.x + 9.0.x

What: Configure fail2ban to watch the failed logins of your ownCloud instance Source: Collected from: https://forum.owncloud.org/viewtopic.php?f=31&t=26336 Target: Tested on ownCloud 8.0.3, 8.1.0, 8.2.0 and 9.0.0 on Debian (Jessie) How: Create a file /etc/fail2ban/filter.d/owncloud.conf with the following content: oC 8.2.0 + 9.0.0 [Definition] failregex={"reqId":".*","remoteAddr":".*","app":"core","message":"Login failed: '.*' \(Remote IP: '<HOST>'\)","level":2,"time":".*"} ignorereg…

[2]

Issue: Reorder the elements of the log entries to make the logs easier to read

[3]

ownCloud 10.0.0 will change the owncloud.log format a bit

Starting from ownCloud 10.0.0, the owncloud.log file will reorder the elements of each log entry in order to make the logs easier to read. The reasons for this changes are explained in https://github.com/owncloud/core/issues/27397 As an example of how the logs looks like with the change, you can check the following logs: {"reqId":"heXNVIiTLeSrcxje601b","level":2,"time":"2017-04-04T07:19:16+00:00","remoteAddr":"10.0.2.4","user":"--","app":"core","method":"POST","url":"\/index.php\/login",…

[ruuskil]

Thanks, got it working! My syntax is now like this:

[Definition]
failregex={"reqId":".*","level":2,"time":".*","remoteAddr":".*","user":".*","app":"core","method":"POST","url":".*","message":"Login failed: '.*' \(Remote IP: '<HOST>'\)"}

[anon81984126]

Nice. Some one seems to also have already picked this up for the documentation:

Issue: Document how to handle failed ownCloud 9.1 and 10 logins with fail2ban