主页 / server / 问题 / 1045839
Accepted
Charm_quark
Asked: 2020-12-12 08:00:11 +0800 CST

Fail2ban 不在 odoo 日志上执行正则表达式

  • 772

我已经用 odoo 13 安装了 fail2ban。

下面是我的配置和示例输出，但我似乎无法弄清楚为什么它不过滤。

user@tempdev:/etc/fail2ban# fail2ban-regex -v /var/log/odoo/odoo.log /etc/fail2ban/filter.d/odoo-login.conf

Running tests
=============

Use   failregex filter file : odoo-login, basedir: /etc/fail2ban
Use         log file : /var/log/odoo/odoo.log
Use         encoding : UTF-8


Results
=======

Failregex: 0 total
|-  #) [# of hits] regular expression
|   1) [0] ^\d+ INFO \S+ \S+ Login failed for db:\S+ login:\S+ from <HOST>
`-

user@tempdev:/etc/fail2ban# cat /var/log/odoo/odoo.log | grep '登录失败'

2020-12-11 12:54:06,442 1620 INFO TestSRV odoo.addons.base.models.res_users: Login failed for db:TestSRV login:asfd from 1.2.23.3 
2020-12-11 13:11:20,945 1620 INFO TestSRV odoo.addons.base.models.res_users: Login failed for db:TestSRV login:asfd from 1.2.23.3 
2020-12-11 13:12:07,928 1620 INFO TestSRV odoo.addons.base.models.res_users: Login failed for db:TestSRV login:asdf from 1.2.23.3
ubuntu python fail2ban odoo

1 个回答

  1. Best Answer

    Fail2ban 肯定会删除字符串匹配的日期模式的部分，但仍然有一个空格，所以你必须\s*在锚之前添加\d+：

    -failregex = ^\d+ INFO \S+ \S+ Login failed for db:\S+ login:\S+ from <HOST>
+failregex = ^\s*\d+ INFO \S+ \S+ Login failed for db:\S+ login:\S+ from <HOST>
    • 1

相关问题