# Fail2Ban filter for tt-rss
#

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[Definition]

failregex = ^.*Failed login attempt for .* from <HOST> .*tt-rss.*$
ignoreregex =

# DEV Notes:
#
# pattern :
# 2018/11/02 23:20:15 [error] 967#967: *398052 FastCGI sent in stderr: "PHP message: PHP Warning: Failed login attempt for username from 123.123.123.123 in /path/to/tt-rss/classes/handler/public.php on line 505" while reading response header from upstream, client: 123.123.123.123, server: , request: "POST /public.php?return=%2F HTTP/2.0", upstream: "fastcgi://unix:/var/run/fpm-123.sock:", host: "hosturl.com:port", referrer: "https://hosturl.com/"