diff options
| author | Eric Lesiuta <elesiuta@gmail.com> | 2020-12-08 12:54:33 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-12-08 18:54:33 +0100 |
| commit | abb9cffe4a9b36c124b1ef8fad4a00eff4ba36de (patch) | |
| tree | c2700e2ee86ac70a5f50979aed172f3de197d3dc /docs/content | |
| parent | 42354dfe45fa0cabb59674b896c44a55a56cf163 (diff) | |
| download | gitea-abb9cffe4a9b36c124b1ef8fad4a00eff4ba36de.tar.gz gitea-abb9cffe4a9b36c124b1ef8fad4a00eff4ba36de.zip | |
Log IP on SSH authentication failure for Built-in SSH server (#13150)
* Log IP on SSH authentication failure
fixes https://github.com/go-gitea/gitea/issues/13094
* include string 'Failed authentication attempt' in error
* update fail2ban docs
also match failed authentication over command line
* better logging of authentication errors with IP addresses
* format ...
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Co-authored-by: 6543 <6543@obermui.de>
Diffstat (limited to 'docs/content')
| -rw-r--r-- | docs/content/doc/usage/fail2ban-setup.en-us.md | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/docs/content/doc/usage/fail2ban-setup.en-us.md b/docs/content/doc/usage/fail2ban-setup.en-us.md index ad99ca9e28..42b61416be 100644 --- a/docs/content/doc/usage/fail2ban-setup.en-us.md +++ b/docs/content/doc/usage/fail2ban-setup.en-us.md @@ -20,18 +20,24 @@ sure to test this before relying on it so you don't lock yourself out.** Gitea returns an HTTP 200 for bad logins in the web logs, but if you have logging options on in `app.ini`, then you should be able to go off of `log/gitea.log`, which gives you something like this -on a bad authentication: +on a bad authentication from the web or CLI using SSH or HTTP respectively: ```log 2018/04/26 18:15:54 [I] Failed authentication attempt for user from xxx.xxx.xxx.xxx ``` +```log +2020/10/15 16:05:09 modules/ssh/ssh.go:188:publicKeyHandler() [E] SearchPublicKeyByContent: public key does not exist [id: 0] Failed authentication attempt from xxx.xxx.xxx.xxx +``` +```log +2020/10/15 16:08:44 ...s/context/context.go:204:HandleText() [E] invalid credentials from xxx.xxx.xxx.xxx +``` Add our filter in `/etc/fail2ban/filter.d/gitea.conf`: ```ini # gitea.conf [Definition] -failregex = .*Failed authentication attempt for .* from <HOST> +failregex = .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST> ignoreregex = ``` |