share/fail2ban/filter.d/hybbx-websocket.conf


1
2
3
4
5
6
7
8
9
10
11

# HyBBX WebSocket transport login brute-force (security.log).
# Enable when [transport.websocket] is running and logs login_fail
# with transport=websocket to security.log.

[INCLUDES]
before = common.conf

[Definition]
_daemon = hybbx
failregex = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} login_fail ip=<HOST> user=.* transport=websocket
ignoreregex =