1

I have created a new filter in fail2ban for my owncloud installation. When I tested it with fail2ban-regex it returned matches, so I figured it was working. When I turn it on in the jail however it doesn't ban, and I'm having trouble figuring out why.

I created this filter (owncloud.conf):

[Definition]
failregex = \"message\":"Login failed: '.*' \(Remote IP: '<HOST>\)\"
ignoreregex =

Testing with fail2ban-regex:

fail2ban-regex /home/villermen/hdd/owncloud/owncloud.log
config/fail2ban/filter.d/owncloud.conf

Running tests
=============

Use   failregex file : config/fail2ban/filter.d/owncloud.conf
Use         log file : /home/villermen/hdd/owncloud/owncloud.log


Results
=======

Failregex: 80 total
|-  #) [# of hits] regular expression
|   1) [80] \"message\":"Login failed: '.*' \(Remote IP: '<HOST>\)\"
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [440447] ISO 8601
`-

Lines: 440447 lines, 0 ignored, 80 matched, 440367 missed
Missed line(s):: too many to print.  Use --print-all-missed to print all 440367 lines

The actual jail:

[owncloud]
enabled = true
filter = owncloud
logpath = /home/villermen/hdd/owncloud/owncloud.log
port = http,https

I'm using Ubuntu 14.04 and Fail2ban 0.8.11-1.

1 Answer 1

2

I've figured out the issue myself using the verbose option of the fail2ban-regex command (-v). This shows what ip's and times it has collected. The times were all off by one hour. This is probably an issue in ownCloud, and I'll post here when I have an actual fix.

Fix:

ownCloud uses the non-system, non-php default timezone of Europe/Berlin by default (I'm on Europe/Amsterdam, which is one hour earlier). I found this info on their documentation for config.php. Adding

'logtimezone' => 'Europe/Amsterdam',

Did the trick, so now everyone can get banned again =)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .