Software /
code /
prosody-modules
File
mod_log_auth/README.markdown @ 5119:048e339706ba
mod_rest: Remove manual reference expansion in schema
This hack was originally added to reduce the number of definitions of
common attributes (type, to, from etc) and payloads (e.g. delay). This
predated pointers and references, and until now was needed because
parsing picked out the correct stanza kind from the schema, which broke
internal references.
Removing this hack paves the way for allowing the schema to be
configured or customized more easily.
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Tue, 20 Dec 2022 21:48:28 +0100 |
parent | 2347:a47520a2c59d |
line wrap: on
line source
--- labels: - 'Stage-Stable' summary: Log failed authentication attempts with their IP address ... Introduction ============ Prosody doesn't write IP addresses to its log file by default for privacy reasons (unless debug logging is enabled). This module enables logging of the IP address in a failed authentication attempt so that those trying to break into accounts for example can be blocked. fail2ban configuration ====================== fail2ban is a utility for monitoring log files and automatically blocking "bad" IP addresses at the firewall level. With this module enabled in Prosody you can use the following example configuration for fail2ban: # /etc/fail2ban/filter.d/prosody-auth.conf # Fail2Ban configuration file for prosody authentication [Definition] failregex = Failed authentication attempt \(not-authorized\) for user .* from IP: <HOST> ignoreregex = And at the appropriate place (usually the bottom) of /etc/fail2ban/jail.conf add these lines: [prosody] enabled = true port = 5222 filter = prosody-auth logpath = /var/log/prosody/prosody*.log maxretry = 6 Compatibility ------------- ------- -------------- trunk Works 0.9 Works 0.8 Doesn't work ------- --------------