From ed6068f6a0fcad52e1d162359b3a7578b13407dc Mon Sep 17 00:00:00 2001
From: JES <37674956+EmsTatay@users.noreply.github.com>
Date: Mon, 2 Apr 2018 10:52:52 -0700
Subject: [PATCH] Create piwik-2018A.conf

Sample Filter to use with piwik2.con jail. The two will enable usage of the plugin provided by Patrick
---
 piwik-2018A.conf | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 piwik-2018A.conf

diff --git a/piwik-2018A.conf b/piwik-2018A.conf
new file mode 100644
index 0000000..ac10ad3
--- /dev/null
+++ b/piwik-2018A.conf
@@ -0,0 +1,37 @@
+# -------------------------------------------------------------------------
+# Fail2Ban filter for piwik     /etc/fail2ban/filter.d/piwik-2018A.conf
+# Called by jail                /etc/fail2ban/jail.d/piwik2.conf
+# -------------------------------------------------------------------------
+# Author: Jes Andresen      2018-03
+# Fail2Ban configuration file for Piwik with LoginFailLog plugin by Patrick
+#   https://github.com/patrickbr/piwik-LoginFailLog
+# -------------------------------------------------------------------------
+# NOTE: I modified php code in the plugin to write "PIWIK" in the logline 
+#       to prevent ambiguity ... Sample of MY Log entries for piwik:
+#
+# WARNING LoginFailLog[2017-07-22 23:35:20] [b215d] Failed PIWIK login from 172.217.22.227 with username 
+#
+# IF you do NOT modify the plugin php ... swap the commented failregex line
+# -------------------------------------------------------------------------
+# 
+
+[Definition]
+_daemon = piwik2
+
+# Option:  failregex
+# Values:  TEXT
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+#          failregex = ^%(__prefix_line)sAuthentication failure for .* from <HOST>$
+#   
+
+# failregex = .* Failed login from <HOST> with username .*
+failregex = .* Failed PIWIK login from <HOST> with username .*
+
+# Option:  ignoreregex
+# Values:  TEXT
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+#
+ignoreregex =