#
# Fail2Ban filter for XRDP
#
# Detects login attempts with invalid credentials
#
# Requirements:
#   - xrdp >= 0.9.19
#   - The log level in sesman.ini should be set to `INFO` or higher
#     to emit the log messages needed for this filter.
#
# Author: Evan Linde
#

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf


[DEFAULT]

_daemon = xrdp-sesman


[Definition]

authfail_re = \[INFO \] AUTHFAIL: user=<F-USER>(?:\S+|.+)</F-USER> ip=<ADDR> time=\d+

failregex = ^%(__prefix_line)s%(authfail_re)s$

ignoreregex =

datepattern = ^\[?%%ExY%%Exm%%Exd-%%ExH:%%ExM:%%ExS\]?
              ^{DATE}
