Fail2ban & logs

[blandureauj-hash]

Hello,

I'm trying to get fail2ban to work with OpenCloud.
So far, the only method I've found is:

• OC_LOG_LEVEL = INFO
• Parsing the logs with the regex "remote-addr":"(?P\d{1,3}(?:.\d{1,3}){3})".*"status":204

(I've tried a few things, and login errors are giving this 204 error).

Is there another method (INFO logs are a bit cumbersome...) and/or other errors to watch out for?

Thanks

[micbar]

PROXY_LOG_LEVEL= info only enables the access log in the proxy where every status code of every request is logged.

That should be exactly what you need for Fail2Ban.

[kramttocs]

So just to confirm: 204 is what's expected for failed logins?

[kramttocs]

@blandureauj-hash Did you get a working filter going for the proxy access logs? I am seeing 204 for other things besides login failures.

[kramttocs]

Did a little googling on this and seems like 401/403 would be the standard for a failed login log entry. I understand there is some ambiguity of the standards since a response was sent.

Is this something that could be considered?

[micbar]

204 might be coming from the built-in OIDC server libre-connect.

We ship that with opencloud for conveniance and testing.

Production systems should use keycloak or something like that.

[micbar]

https://github.com/libregraph/lico

[kramttocs]

So if I set my instance up without touching keycloak values in .env then it's using libre-connect for the login/auth handling?

[kramttocs]

I did look in that project and see that 204 is a failed login response.