Dotaz: Jak sestavit fail2ban filtr pro mosquitto mqtt?

[debuntu]

Ahoj,

neni tady nejaky opravdovy znalec regularnich vyrazu, ktery by mi pomohl sestavit fail2ban filtr pro mosquitto mqtt? Na internetu vsude popisuji konfiguraci pro starsi verzi programu, ktera logovala uplne jine stringy, takze to nefunguje.

Log vypada nejak takto

1668687841: Client (unknown) disconnected, not authorised.
1668687846: New connection from 37.188.167.100:61059 on port 8883.
1668687846: Client (unknown) disconnected, not authorised.
1668687846: New connection from 37.188.167.100:61060 on port 8883.
1668687847: Client (unknown) disconnected, not authorised.
1668687847: New connection from 37.188.167.100:61061 on port 8883.
1668687848: Client (unknown) disconnected, not authorised.
1668687850: New connection from 37.188.167.100:61062 on port 8883.
1668687850: Client (unknown) disconnected, not authorised.
1668687854: New connection from 37.188.167.100:61063 on port 8883.

more /etc/fail2ban/filter.d/mosquitto-auth.conf

[INCLUDES]
before = common.conf

[Init]
maxlines = 2

[Definition]
failregex = .+ New connection from (HOST) on port \d+\.\n.+\n.+ Client (unknown) disconnected, not authorised.

ignoreregex =

Diky moc

Odpovědi

[X]

Je to uplne stejne akorat hadam za hostem je jeste cislo portu klienta a to (HOST) je nejaky interni makro pro IP adresu(?).

failregex = .+ New connection from (HOST):\d+ on port \d+.\n.+\n.+ Client (unknown) disconnected, not authorised.

[X]

Jeste si myslim, ze \d+.\n.+\n.+ ma byt jen \d+.\n.+'.

[debuntu]

Ani jedna varianta nefunguje. Ale to je jedno. Mosquitto neloguje unikatni identifikator spojeni, takze to nelze spolehlive detekovat.

[debuntu]

Kazdopadne dekuji za snahu o pomoc.

[[Jooky]]

mosquitto dostupne z internetu ???

[debuntu]

Ja vim, ale kdyz ono se to IOT bez internetu hur provozuje.

[Peter Golis]

Malo by to byť v intranete pomocou VPN cez internet. Ale ako chceš.

[Bugsa]

Problém v regexu je ten, že nemáš oescapované "(" a ")" u "(unknown)".

Tento regex by měl fungovat

.+ New connection from (HOST)\:\d+ on port \d+\.\n.+Client \(unknown\) disconnected, not authorised\.

Ta proměnná HOST by měla být v hranatých závorkách < a >. Redakční systém mi to nedovolil, tak jsem to nechal v kulatých.