A
A
AndreyTT2018-04-18 14:13:54
proxy
AndreyTT, 2018-04-18 14:13:54

How to write a fail2ban filter for 3proxy?

There are 3proxy for socks5 with name authorization.
the log is issued in the format:

log /var/log/3proxy/3proxy.log D
logformat "- +_L%t.%. %N.%p %E %U %C:%c %R:%r %O %I %h %T"
archiver gz /usr/bin/gzip %F
rotate 30

For example:
1524040060.517 SOCK5.2121 00006 user 10.10.10.10:222 11.11.11.11:443 0 0 0 CONNECT_11.11.11.11:443
I want to configure fail2ban and I can't write a working filter to these logs. Standard:
[Definition]
failregex = ^\s[+-]\d{4} \S+ \d{3}0[1-9] \S+ <HOST>:\d+ [\d.]+:\d+ \d+ \d+ \d+\s

doesn't read anything.
And the second question: the names of the log file in 3proxy change from date to date, how can I specify this in jail.local? In the guides it is written everywhere only about the statically named log file.

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question