noob Feedback

piwik-2018A.conf

@@ -0,0 +1,37 @@
+# -------------------------------------------------------------------------
+# Fail2Ban filter for piwik     /etc/fail2ban/filter.d/piwik-2018A.conf
+# Called by jail                /etc/fail2ban/jail.d/piwik2.conf
+# -------------------------------------------------------------------------
+# Author: Jes Andresen      2018-03
+# Fail2Ban configuration file for Piwik with LoginFailLog plugin by Patrick
+#   https://github.com/patrickbr/piwik-LoginFailLog
+# -------------------------------------------------------------------------
+# NOTE: I modified php code in the plugin to write "PIWIK" in the logline 
+#       to prevent ambiguity ... Sample of MY Log entries for piwik:
+#
+# WARNING LoginFailLog[2017-07-22 23:35:20] [b215d] Failed PIWIK login from 172.217.22.227 with username 
+#
+# IF you do NOT modify the plugin php ... swap the commented failregex line
+# -------------------------------------------------------------------------
+# 
+
+[Definition]
+_daemon = piwik2
+
+# Option:  failregex
+# Values:  TEXT
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+#          failregex = ^%(__prefix_line)sAuthentication failure for .* from <HOST>$
+#   
+
+# failregex = .* Failed login from <HOST> with username .*
+failregex = .* Failed PIWIK login from <HOST> with username .*
+
+# Option:  ignoreregex
+# Values:  TEXT
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+#
+ignoreregex =