Owncloud fail2ban
From Karmaking
from http://www.dataparadis.net/osp/gnu-linux-server/cloud-server/owncloud-and-fail2ban-update/
To make OC write auth failures to a logfile, modify path/to/owncloud/lib/user/database.php and insert in public function checkPassword( $uid, $password ) (~line 202) - just before the return false statement:
$today = new DateTime();
date_timezone_set($today, timezone_open('Europe/Berlin'));
$IPClient= $_SERVER['REMOTE_ADDR'];
$logAuth = fopen('/var/log/owncloud-fail.log', 'a+');
fputs($logAuth, date_format($today, 'Y/m/d H:i:s') . " Password check failed for: \t" . $IPClient . "\n");
fclose($logAuth);
and a few lines later, around line 220, ahead of the last return false in the function:
$today = new DateTime();
date_timezone_set($today, timezone_open('Europe/Berlin'));
$IPClient= $_SERVER['REMOTE_ADDR'];
$logAuth = fopen('/var/log/owncloud-fail.log', 'a+');
fputs($logAuth, date_format($today, 'Y/m/d H:i:s') . " Invalid username: \t" . $IPClient . "\n");
fclose($logAuth);
/etc/fail2ban/jail.conf
[Owncloud] enabled = true port = http,https filter = owncloud logpath = /var/log/owncloud-fail.log maxretry = 6
/etc/fail2ban/filter.d/owncloud.conf
# /etc/fail2ban/filter.d/owncloud.conf # # Fail2Ban configuration file # By Anthony25 and Malekith25 # Owncloud #
[Definition] # Option: failregex # Filter Ban in /var/log/owncloud-fail.log failregex = <HOST>$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # ignoreregex =