Edit File: mssql-auth.conf
# Fail2Ban filter for failed MSSQL Server authentication attempts [Definition] failregex = ^\s*Logon\s+Login failed for user '<F-USER>(?:[^']*|.*)</F-USER>'\. [^'\[]+\[CLIENT: <ADDR>\]$ # DEV Notes: # Tested with SQL Server 2019 on Ubuntu 18.04 # # Example: # 2020-02-24 14:48:55.12 Logon Login failed for user 'root'. Reason: Could not find a login matching the name provided. [CLIENT: 127.0.0.1] # # Author: Rüdiger Olschewsky #