Pedulla

Ah, great point. I would need to count as a failure the not found user and: `02/27/20 09:14:33.603985 web_php[1864].ERR [192.168.0.100] [Login denied for user "admin"] at includes/auth.php line 278 `...

> Well I'm not sure... > ZM has gone from http auth to bcrypt. The new log to watch is /var/log/zm/web_php.log

> No, I don't think so, it is enough to anchor it to begin only: > stand by; reading again.... missed the -or- :/ That seems to work well. I'll...

Works great with: ``` sudo fail2ban-regex -v /var/log/zm/web_php.log /etc/fail2ban/filter.d/zoneminder.conf Running tests ============= Use failregex filter file : zoneminder, basedir: /etc/fail2ban Use datepattern : ^Month/Day/Year2 24hour:Minute:Second(?:\.Microseconds) Use log file : /var/log/zm/web_php.log...

My bad, pasted wrong content :/ edited post.

Yeah, caught that. fixed. Starting new tests. Quick side question, are the ports definitions read from the /etc/services file?

I'm just using default actions. getting closer.... Found this in the fail2ban.log: `2020-02-27 13:28:51,212 fail2ban.actions [3840]: ERROR Failed to start jail 'zoneminder' action 'iptables-multiport': Error starting action Jail('zoneminder')/iptables-multiport ` I've...

Welp, that's the limit of my understanding. I'm using a stock UB18.04.4 LTS server. I'm not the guy who modifies his kernel. Now my Chevy is another story ;) That...

I'm going to try the obvious and just list each port individually... linear, I know, but trouble shooting.

Well, this is embarrassing.... bantime = 1hr doesn't work multiport works fine. spec'ing ports in /.../services works fine. new zoneminder filter works fine. Thanks for your time and patients.