starred/vaultwarden
1
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-04-26 09:46:00 +03:00
Code Issues 39 Projects Releases 5 Packages Wiki Activity

[GH-ISSUE #678] fail2ban regex will match but no match found when actually running #455

New issue
Closed
opened 2026-03-03 01:29:18 +03:00 by kerem · 6 comments
kerem commented 2026-03-03 01:29:18 +03:00
Owner
Copy link

Originally created by @Ezzahhh on GitHub (Oct 22, 2019).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/678

I have followed the instructions in the wiki to setup fail2ban. My setup is with caddy and bitwarden_rs both running in docker with root and using cloudflare cdn for https. My log is being output in /bw-data/bitwarden.log and it appears to be updating. My OS time and the log time appear to match up. When I run fail2ban's regex on the given one in the wiki and the bitwarden.conf it appears to find matches. However, when I try to spam logins myself the fail2ban log does not show any indication that anything is happening even with the verbosity set to DEBUG. Comparatively, the ssh blocking appears to work.

bitwarden.conf

[INCLUDES]
before = common.conf

[Definition]
failregex = ^.*Username or password is incorrect\. Try again\. IP: <HOST>\. Username:.*$
ignoreregex =

bitwarden.local

[bitwarden]
enabled = true
port = 80,443
filter = bitwarden
action = iptables-allports[name=bitwarden]
logpath = /bw-data/bitwarden.log
maxretry = 3
bantime = 14400
findtime = 14400

fail2ban.log it basically just does usual startup and ends like this:

2019-10-22 23:05:34,232 fail2ban.jail [15452]: INFO Jail 'bitwarden' started

Originally created by @Ezzahhh on GitHub (Oct 22, 2019). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/678 I have followed the instructions in the wiki to setup fail2ban. My setup is with caddy and bitwarden_rs both running in docker with root and using cloudflare cdn for https. My log is being output in /bw-data/bitwarden.log and it appears to be updating. My OS time and the log time appear to match up. When I run fail2ban's regex on the given one in the wiki and the bitwarden.conf it appears to find matches. However, when I try to spam logins myself the fail2ban log does not show any indication that anything is happening even with the verbosity set to DEBUG. Comparatively, the ssh blocking appears to work. bitwarden.conf ``` [INCLUDES] before = common.conf [Definition] failregex = ^.*Username or password is incorrect\. Try again\. IP: <HOST>\. Username:.*$ ignoreregex = ``` bitwarden.local ``` [bitwarden] enabled = true port = 80,443 filter = bitwarden action = iptables-allports[name=bitwarden] logpath = /bw-data/bitwarden.log maxretry = 3 bantime = 14400 findtime = 14400 ``` fail2ban.log it basically just does usual startup and ends like this: `2019-10-22 23:05:34,232 fail2ban.jail [15452]: INFO Jail 'bitwarden' started`
kerem closed this issue 2026-03-03 01:29:18 +03:00
kerem commented 2026-03-03 01:29:19 +03:00
Author
Owner
Copy link

@hwwilliams commented on GitHub (Oct 22, 2019):

Hey @Ezzahhh , you may have to use the following action in bitwarden.local since you're using docker and docker uses the forward chain in iptables.

action = iptables-allports[name=bitwarden, chain=FORWARD]

<!-- gh-comment-id:545189110 --> @hwwilliams commented on GitHub (Oct 22, 2019): Hey @Ezzahhh , you may have to use the following action in bitwarden.local since you're using docker and docker uses the forward chain in iptables. `action = iptables-allports[name=bitwarden, chain=FORWARD]`
kerem commented 2026-03-03 01:29:19 +03:00
Author
Owner
Copy link

@Ezzahhh commented on GitHub (Oct 23, 2019):

My understanding from the wiki was to not include the chain forward because I have docker AND caddy as a reverse proxy in front. Wouldn't jail2ban normally show something in logs if it at least picked up something to ban in logs before taking action? I'm no sure. It's weird because I get nothing at all.

I have tried running with chain=FORWARD but nothing happens.

<!-- gh-comment-id:545252423 --> @Ezzahhh commented on GitHub (Oct 23, 2019): My understanding from the wiki was to not include the chain forward because I have docker AND caddy as a reverse proxy in front. Wouldn't jail2ban normally show something in logs if it at least picked up something to ban in logs before taking action? I'm no sure. It's weird because I get nothing at all. I have tried running with chain=FORWARD but nothing happens.
kerem commented 2026-03-03 01:29:19 +03:00
Author
Owner
Copy link

@hwwilliams commented on GitHub (Oct 23, 2019):

In that case I'm not too sure, I'm also using docker but with Traefik instead of Caddy. I use the chain=forward action as I mentioned and its working fine for me with no changes to Traefik.

Perhaps someone else can chime in.

<!-- gh-comment-id:545272822 --> @hwwilliams commented on GitHub (Oct 23, 2019): In that case I'm not too sure, I'm also using docker but with Traefik instead of Caddy. I use the `chain=forward` action as I mentioned and its working fine for me with no changes to Traefik. Perhaps someone else can chime in.
kerem commented 2026-03-03 01:29:19 +03:00
Author
Owner
Copy link

@Ezzahhh commented on GitHub (Oct 23, 2019):

Yeah it's definitely something to do with my bitwarden config, because fail2ban is banning IPs for sshd and that is working fine.

When I run : fail2ban-regex /bw-data/bitwarden.log /etc/fail2ban/filter.d/bitwarden.conf

I definitely get matches on previous failed logins

Running tests
=============

Use   failregex filter file : bitwarden, basedir: /etc/fail2ban
Use      datepattern : Default Detectors
Use         log file : /bw-data/bitwarden.log
Use         encoding : UTF-8


Results
=======

Failregex: 167 total
|-  #) [# of hits] regular expression
|   1) [167] ^.*Username or password is incorrect\. Try again\. IP: <HOST>\. Username:.*$
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [285360] {^LN-BEG}ExYear(?P<_sep>[-/.])Month(?P=_sep)Day(?:T|  ?)24hour:Minute:Second(?:[.,]Microseconds)?(?:\s*Zone offset)?
`-

Lines: 285360 lines, 0 ignored, 167 matched, 285193 missed
[processed in 10.88 sec]

Missed line(s): too many to print.  Use --print-all-missed to print all 285193 lines
<!-- gh-comment-id:545277725 --> @Ezzahhh commented on GitHub (Oct 23, 2019): Yeah it's definitely something to do with my bitwarden config, because fail2ban is banning IPs for sshd and that is working fine. When I run : fail2ban-regex /bw-data/bitwarden.log /etc/fail2ban/filter.d/bitwarden.conf I definitely get matches on previous failed logins ``` Running tests ============= Use failregex filter file : bitwarden, basedir: /etc/fail2ban Use datepattern : Default Detectors Use log file : /bw-data/bitwarden.log Use encoding : UTF-8 Results ======= Failregex: 167 total |- #) [# of hits] regular expression | 1) [167] ^.*Username or password is incorrect\. Try again\. IP: <HOST>\. Username:.*$ `- Ignoreregex: 0 total Date template hits: |- [# of hits] date format | [285360] {^LN-BEG}ExYear(?P<_sep>[-/.])Month(?P=_sep)Day(?:T| ?)24hour:Minute:Second(?:[.,]Microseconds)?(?:\s*Zone offset)? `- Lines: 285360 lines, 0 ignored, 167 matched, 285193 missed [processed in 10.88 sec] Missed line(s): too many to print. Use --print-all-missed to print all 285193 lines ```
kerem commented 2026-03-03 01:29:19 +03:00
Author
Owner
Copy link

@dani-garcia commented on GitHub (May 13, 2020):

Closed due to inactivity.

<!-- gh-comment-id:628276628 --> @dani-garcia commented on GitHub (May 13, 2020): Closed due to inactivity.
kerem commented 2026-03-03 01:29:20 +03:00
Author
Owner
Copy link

@savowe commented on GitHub (Dec 21, 2020):

I had the very same issue. Tried some things posted in other issues such as checking for correct timezone settings and so forth nothing worked. Even though fail2ban-regex got all the correct hits with the regex ^.*Username or password is incorrect\. Try again\. IP: <HOST>\. Username:.*$' it would not work when actually running fail2ban.
It started working when I changed the timestamp to
-e LOG_TIMESTAMP_FORMAT="%Y-%m-%d %H:%M:%S"
leaving out the %3f at the end.

<!-- gh-comment-id:748698776 --> @savowe commented on GitHub (Dec 21, 2020): I had the very same issue. Tried some things posted in other issues such as checking for correct timezone settings and so forth nothing worked. Even though `fail2ban-regex` got all the correct hits with the regex `^.*Username or password is incorrect\. Try again\. IP: <HOST>\. Username:.*$'` it would not work when actually running fail2ban. It started working when I changed the timestamp to `-e LOG_TIMESTAMP_FORMAT="%Y-%m-%d %H:%M:%S"` leaving out the `%3f` at the end.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
revert-7033-patch-1
cached-config-operations
test_dylint
1.35.8
1.35.7
1.35.6
1.35.5
1.35.4
1.35.3
1.35.2
1.35.1
1.35.0
1.34.3
1.34.2
1.34.1
1.34.0
1.33.2
1.33.1
1.33.0
1.32.7
1.32.6
1.32.5
1.32.4
1.32.3
1.32.2
1.32.1
1.32.0
1.31.0
1.30.5
1.30.4
1.30.3
1.30.2
1.30.1
1.30.0
1.29.2
1.29.1
1.29.0
1.28.1
1.28.0
1.27.0
1.26.0
1.25.2
1.25.1
1.25.0
1.24.0
1.23.1
1.23.0
1.22.2
1.22.1
1.22.0
1.21.0
1.20.0
1.19.0
1.18.0
1.17.0
1.16.3
1.16.2
1.16.1
1.16.0
1.15.1
1.15.0
1.14.2
1.14.1
1.14
1.13.1
1.13.0
1.12.0
1.11.0
1.10.0
1.9.1
1.9.0
1.8.0
1.7.0
1.6.1
1.6.0
1.5.0
1.4.0
1.3.0
1.2.0
1.1.0
1.0.0
0.13.0
0.12.0
0.11.0
0.10.0
0.9.0
Labels
Clear labels   
SSO

   
Third party

   
better for forum

   
bug

   
bug

   
documentation

   
duplicate

   
enhancement

   
future Vault

   
future Vault

   
future Vault

   
good first issue

   
help wanted

   
low priority

   
notes

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
troubleshooting

   
wontfix
No labels
SSO
Third party
better for forum
bug
bug
documentation
duplicate
enhancement
future Vault
future Vault
future Vault
good first issue
help wanted
low priority
notes
pull-request
question
troubleshooting
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/vaultwarden#455
No description provided.