Fail2ban How to configure regex expression?

Question

Python

fail2ban-server -V
Fail2Ban v0.9.7
There was a need to restrict access to port 873 on the server, I sketched a config:
fail2ban/jail.d/rsyncd.conf

[rsyncd]
enabled=true
port=873
filter=rsyncd
logpath= /var/log/
rsyncd.log maxretry=3
findtime=600
bantime=3600

fail2ban/filter.d/rsyncd.conf

[Definition]
failregex = \auth failed on module .* from .* \(\/) for .*: password mismatch
ignoreregex =

In the logs themselves, the message looks like this:

2019/10/02 09:19:29 [104094] connect from UNDETERMINED (10.20.15.18
) mismatch

As far as I understand, the problem is in the expression itself:

failregex = \auth failed on module .* from .* \(\/) for .*: password mismatch

Tell me where is the mistake, please.

Answer 1

failregex = auth failed on module [^ ]+ from [^ ]+ \(([0-9.]+)\) for [^ ]+: password mismatch