One Hat Cyber Team

Your IP : 3.133.154.12

Server IP : 104.21.64.1

Server : Linux agrigation-prod 5.15.0-67-generic #74-Ubuntu SMP Wed Feb 22 14:14:39 UTC 2023 x86_64

Server Software : nginx/1.24.0

PHP Version : 7.4.33

Buat File | Buat Folder

Dir : ~/etc/fail2ban/filter.d/

Edit File: ejabberd-auth.conf

# Fail2Ban configuration file
#
# Author: Steven Hiscocks
#
#

[Definition]

# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
#          Multiline regexs should use tag "<SKIPLINES>" to separate lines.
#          This allows lines between the matching lines to continue to be
#          searched for other failures. This tag can be used multiple times.
# Values:  TEXT
#
failregex = ^=INFO REPORT====  ===\nI$<0\.\d+\.0>:ejabberd_c2s:\d+$ : $[^)]+$ Failed authentication for \S+ from (?:IP )?<HOST>(?: ${{(?:\d+,){3}\d+},\d+}$)?$
            ^(?:\.\d+)? \[info\] <0\.\d+\.\d>@ejabberd_c2s:\w+:\d+ $[^$]+\) Failed (?:c2s \w+ )?authentication for \S+ from (?:IP )?(?:::FFFF:)?<HOST>(?:: |$)

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

# "maxlines" is number of log lines to buffer for multi-line regex searches
maxlines = 2

# Option:  journalmatch
# Notes.:  systemd journalctl style match filter for journal based backend
# Values:  TEXT
#
journalmatch =

#datepattern = ^(?:=[^=]+={3,} )?({DATE})
# explicit time format using prefix =...==== and no date in second string begins with I(...)... 
datepattern = ^(?:=[^=]+={3,} )?(%%ExY(?P<_sep>[-/.])%%m(?P=_sep)%%d[T ]%%H:%%M:%%S(?:[.,]%%f)?(?:\s*%%z)?)
              ^I\(()**