mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-23 03:27:02 +09:00
Thomas Vincent
3045b4665e
* Add fail2ban support for authentication failures Emit a fixed, machine-parseable AUTH FAILURE line (user, realm, ip, reason) from the universal login-failure path and the 2FA branch, normalise the human AUTH strings, and ship a fail2ban filter, jail example, and README. The IP comes from get_client_addr(); a crafted username cannot forge fields. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test: resolve includes through Cacti path constants Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
23 lines
761 B
Plaintext
23 lines
761 B
Plaintext
# Fail2Ban filter for Cacti authentication failures.
|
|
#
|
|
# Cacti emits one stable, machine-parseable line per failed authentication
|
|
# attempt (added in 1.3), regardless of realm:
|
|
#
|
|
# AUTH FAILURE user="<user>" realm="<realm>" ip="<ip>" reason="<reason>"
|
|
#
|
|
# realm is one of: local, ldap, domain
|
|
# reason is one of: bad_password, no_such_user, 2fa
|
|
#
|
|
# The ip field always holds a validated address from Cacti's get_client_addr(),
|
|
# which honours the trusted-proxy configuration. See README.md for the reverse
|
|
# proxy caveat.
|
|
|
|
[Definition]
|
|
|
|
failregex = ^.*\bAUTH FAILURE user="[^"]*" realm="[^"]*" ip="<HOST>" reason="[^"]*"\s*$
|
|
|
|
ignoreregex =
|
|
|
|
# Cacti log lines are prefixed with a local-time "YYYY-MM-DD HH:MM:SS" stamp.
|
|
datepattern = ^%%Y-%%m-%%d %%H:%%M:%%S
|