I'm playing around with fail2ban in kubernetes. For that I created a pod that creates fake log messages: 2021-08-04 18:33:13 Authentication failed 15.15.15.15 I created a custom filter, to test if fail2ban is working. I first tried the fail2ban-regex util with a file containing 10 lines of these log messages and got this output:
Running tests
=============
Use failregex filter file : test, basedir: /etc/fail2ban
Use log file : /logs.txt
Use encoding : UTF-8
Results
=======
Failregex: 10 total
|- #) [# of hits] regular expression
| 1) [10] \sAuthentication failed\s<HOST>
`-
Ignoreregex: 0 total
Date template hits:
|- [# of hits] date format
| [10] ExYear(?P<_sep>[-/.])Month(?P=_sep)Day(?:T| ?)24hour:Minute:Second(?:[.,]Microseconds)?(?:\s*Zone offset)?
`-
Lines: 10 lines, 0 ignored, 10 matched, 0 missed
[processed in 0.12 sec]
but when I then try the same filter against the file, that contains the continually logs, I get this error:
Running tests
=============
Use failregex filter file : test, basedir: /etc/fail2ban
Use log file : /logs/kubernetes.logs
Use encoding : UTF-8
Traceback (most recent call last):
File "/usr/bin/fail2ban-regex", line 34, in <module>
exec_command_line()
File "/usr/lib/python3.8/site-packages/fail2ban/client/fail2banregex.py", line 836, in exec_command_line
if not fail2banRegex.start(args):
File "/usr/lib/python3.8/site-packages/fail2ban/client/fail2banregex.py", line 776, in start
self.process(test_lines)
File "/usr/lib/python3.8/site-packages/fail2ban/client/fail2banregex.py", line 584, in process
line_datetimestripped, ret, is_ignored = self.testRegex(line)
File "/usr/lib/python3.8/site-packages/fail2ban/client/fail2banregex.py", line 456, in testRegex
found = self._filter.processLine(line, date)
File "/usr/lib/python3.8/site-packages/fail2ban/server/filter.py", line 613, in processLine
timeMatch = self.dateDetector.matchTime(line)
File "/usr/lib/python3.8/site-packages/fail2ban/server/datedetector.py", line 368, in matchTime
(line[distance] == self.__lastPos[2] and not self.__lastPos[2].isalnum())
IndexError: string index out of range
And when I activate the filter for fail2ban, there i no ip banned, so I think, my filter isn't working, but I cannot find the mistake.
filter.conf:
[Definition]
failregex = \sAuthentication failed\s<HOST>