Software /
code /
prosody-modules
File
mod_log_auth/README.markdown @ 3884:f84ede3e9e3b
mod_auth_external->mod_auth_external_insecure: Unmaintained and almost certainly insecure, discourage its use
author | Matthew Wild <mwild1@gmail.com> |
---|---|
date | Thu, 06 Feb 2020 21:03:17 +0000 |
parent | 2347:a47520a2c59d |
line wrap: on
line source
--- labels: - 'Stage-Stable' summary: Log failed authentication attempts with their IP address ... Introduction ============ Prosody doesn't write IP addresses to its log file by default for privacy reasons (unless debug logging is enabled). This module enables logging of the IP address in a failed authentication attempt so that those trying to break into accounts for example can be blocked. fail2ban configuration ====================== fail2ban is a utility for monitoring log files and automatically blocking "bad" IP addresses at the firewall level. With this module enabled in Prosody you can use the following example configuration for fail2ban: # /etc/fail2ban/filter.d/prosody-auth.conf # Fail2Ban configuration file for prosody authentication [Definition] failregex = Failed authentication attempt \(not-authorized\) for user .* from IP: <HOST> ignoreregex = And at the appropriate place (usually the bottom) of /etc/fail2ban/jail.conf add these lines: [prosody] enabled = true port = 5222 filter = prosody-auth logpath = /var/log/prosody/prosody*.log maxretry = 6 Compatibility ------------- ------- -------------- trunk Works 0.9 Works 0.8 Doesn't work ------- --------------