---

labels:

- 'Stage-Stable'

summary: Log failed authentication attempts with their IP address

...

Introduction

============

Prosody doesn't write IP addresses to its log file by default for

privacy reasons (unless debug logging is enabled).

This module enables logging of the IP address in a failed authentication

attempt so that those trying to break into accounts for example can be

blocked.

fail2ban configuration

======================

fail2ban is a utility for monitoring log files and automatically

blocking "bad" IP addresses at the firewall level.

With this module enabled in Prosody you can use the following example

configuration for fail2ban:

    # /etc/fail2ban/filter.d/prosody-auth.conf

    # Fail2Ban configuration file for prosody authentication

    [Definition]

    failregex = Failed authentication attempt \(not-authorized\) for user .* from IP: <HOST>

    ignoreregex =

And at the appropriate place (usually the bottom) of

/etc/fail2ban/jail.conf add these lines:

    [prosody]

    enabled = true

    port    = 5222

    filter  = prosody-auth

    logpath = /var/log/prosody/prosody*.log

    maxretry = 6

Compatibility

-------------

  ------- --------------

  trunk   Works

  0.9     Works

  0.8     Doesn't work

  ------- --------------