Regular Expressions

Re: fail2ban regex matching on testing sites but not fail2ban itself

4-Nov-21 1:07

I've a weird situation. I created a regex expression for one of the service. I've tested this expression at regexr.com and regex101.com and there are no problems at all. when I used this regex expression in fail2ban, it missed all the lines.

here is the log output;

[05-Oct-2021 17:09:39 +0300]: IMAP Error: Login failed for xyz@xyz.com against localhost from 95.65.143.88. AUTHENTICATE PLAIN: Authentication failed. in /usr/share/roundcube/program/lib/Roundcube/rcube_imap.php on line 204 (POST /webmail/?_task=login&_action=login)

here is the regex;

(IMAP Error: Login failed for)\s([a-zA-Z0-9_.-]+\@[a-zA-Z0-9_.-]+)\s(against localhost from)\s

is fail2ban using a different regex structure?

Richard MacCutchan4-Nov-21 2:07

Richard MacCutchan

4-Nov-21 2:07

What is fail2ban?

Re: fail2ban regex matching on testing sites but not fail2ban itself

murdocklawless4-Nov-21 2:49

Re: fail2ban regex matching on testing sites but not fail2ban itself

4-Nov-21 2:49

fail2ban is checking application logs and prevent intruders.

Peter_in_27804-Nov-21 3:17

Peter_in_2780

4-Nov-21 3:17

fail2ban regexes are a bit "different", particularly with the new(ish) prefixes and interpolations.
Your best bet is to use "fail2ban-regex".
Somewhere around the fail2ban site there is a tutorial about iincremental development of regexes.
It's a bit outdated, but the process works.

Software rusts. Simon Stephenson, ca 1994. So does this signature. me, 2012

Re: fail2ban regex matching on testing sites but not fail2ban itself

murdocklawless4-Nov-21 3:31

Re: fail2ban regex matching on testing sites but not fail2ban itself

4-Nov-21 3:31

yep I'm using fail2ban-regex but before that I'm preparing my expressions at regexr.com.

Peter_in_27804-Nov-21 12:05

Peter_in_2780

4-Nov-21 12:05

My experience with fail2ban regexes is that they are sufficiently different from the "standard" ones that the regular development/test tools don't help.
I think you're stuck with fail2ban-regex, a dummy log file with examples of good and bad entries, and a whole lot of panel-beating, depending on how complex your requirements are.
It's worth looking at the various filter files provided with fail2ban. I found some helpful constructs in ones I don't actually use.

Software rusts. Simon Stephenson, ca 1994. So does this signature. me, 2012

Re: fail2ban regex matching on testing sites but not fail2ban itself

murdocklawless4-Nov-21 13:10

Editing my existing Regex

4-Nov-21 13:10

f2b should have provided standard regex expressions, so people wouldn't need to learn something else.

Member 154173673-Nov-21 1:14

Member 15417367

3-Nov-21 1:14

Hi,
im relatively new to regex and im trying to match OU from the Distinguished Name in ActiveDirectory.

This is my existing regex:
(((OU=.*?))?)OU=(?<ouname>.*?(?=,))

CN=Muster\, Max,[OU=AAD-Sync,OU=IT-Abteilung],[OU=FD] 10,DC=landkreis-Musterstadt,DC=local

So far this would match the OU I marked with [] as two separate Matches, does anyone know ow to edit my existing regex that it matches every OU as one Match instead of two separates?

Would be lovely if I could get some Help Smile | :)

regex to replace accents

Member 1489067816-Sep-21 3:50

16-Sep-21 3:50

I have this regex to replace accents but it fails if the text contains "|".
string Text = "word|word2";

// Regex.
System.Text.RegularExpressions.Regex replace_a_Accents = new System.Text.RegularExpressions.Regex("[á|à|ä|â]", System.Text.RegularExpressions.RegexOptions.Compiled);
System.Text.RegularExpressions.Regex replace_e_Accents = new System.Text.RegularExpressions.Regex("[é|è|ë|ê]", System.Text.RegularExpressions.RegexOptions.Compiled);
System.Text.RegularExpressions.Regex replace_i_Accents = new System.Text.RegularExpressions.Regex("[í|ì|ï|î]", System.Text.RegularExpressions.RegexOptions.Compiled);
System.Text.RegularExpressions.Regex replace_o_Accents = new System.Text.RegularExpressions.Regex("[ó|ò|ö|ô]", System.Text.RegularExpressions.RegexOptions.Compiled);
System.Text.RegularExpressions.Regex replace_u_Accents = new System.Text.RegularExpressions.Regex("[ú|ù|ü|û]", System.Text.RegularExpressions.RegexOptions.Compiled);

// Reemplaza.
Texto_Retorno = replace_a_Accents.Replace(Texto_Retorno, "a");
Texto_Retorno = replace_e_Accents.Replace(Texto_Retorno, "e");
Texto_Retorno = replace_i_Accents.Replace(Texto_Retorno, "i");
Texto_Retorno = replace_o_Accents.Replace(Texto_Retorno, "o");
Texto_Retorno = replace_u_Accents.Replace(Texto_Retorno, "u");

Richard Deeming16-Sep-21 4:28

16-Sep-21 4:28

Why would you use a Regex for something so simple?

bool replacedAny = false;
char[] characters = Texto_Retorno.ToCharArray();
for (int index = 0; index < characters.Length; index++)
{
    switch (characters[index])
    {
        case 'á':
        case 'à':
        case 'ä':
        case 'â':
        {
            characters[index] = 'a';
            replacedAny = true;
            break;
        }
        case 'é':
        case 'è':
        case 'ë':
        case 'ê':
        {
            characters[index] = 'e';
            replacedAny = true;
            break;
        }
        case 'í':
        case 'ì':
        case 'ï':
        case 'î':
        {
            characters[index] = 'i';
            replacedAny = true;
            break;
        }
        case 'ó':
        case 'ò':
        case 'ö':
        case 'ô':
        {
            characters[index] = 'o';
            replacedAny = true;
            break;
        }
        case 'ú':
        case 'ù':
        case 'ü':
        case 'û':
        {
            characters[index] = 'u';
            replacedAny = true;
            break;
        }
    }
}

if (replacedAny)
{
    Texto_Retorno = new string(characters);
}

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

modified 16-Sep-21 10:54am.

Richard MacCutchan16-Sep-21 4:44

Richard MacCutchan

16-Sep-21 4:44

characters[index] = '3'; // ??

Richard Deeming16-Sep-21 4:55

16-Sep-21 4:55

Nothing to see here. :innocent-whistle-smily:

In my defence, "3" is directly above "e" on the keyboard. Laugh | :laugh:

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

Richard MacCutchan16-Sep-21 5:05

Richard MacCutchan

16-Sep-21 5:05

Given some of the nonsense that appears when I type too fast I think you do very well.

Member 1489067816-Sep-21 5:38

16-Sep-21 5:38

I was dreading it, Regex doesn't do the job and doesn't replace either?

Richard Deeming16-Sep-21 5:54

16-Sep-21 5:54

Regex can do the job. But running five+ separate regex operations on a string just to replace a few letters with their unaccented alternatives is overkill.

The other option, which is even nastier and less obvious, is to use Unicode normalization:

static string RemoveDiacritics(string stIn)
{
    string stFormD = stIn.Normalize(NormalizationForm.FormD);
    StringBuilder sb = new StringBuilder();

    for(int ich = 0; ich < stFormD.Length; ich++) 
    {
        UnicodeCategory uc = CharUnicodeInfo.GetUnicodeCategory(stFormD[ich]);
        if (uc != UnicodeCategory.NonSpacingMark) 
        {
            sb.Append(stFormD[ich]);
        }
    }

    return sb.ToString().Normalize(NormalizationForm.FormC);
}

string input = "Príliš žlutoucký kun úpel dábelské ódy.";
string result = RemoveDiacritics(input); // "Prilis zlutoucky kun upel dabelske ody."

Source[^]

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

Member 1489067816-Sep-21 5:39

16-Sep-21 5:39

case 'Á' case 'À' case 'Ó' ... to be continue

Regex Match with Multiple Words, I need you to not use leading and trailing spaces.

Peter_in_278016-Sep-21 4:45

Peter_in_2780

16-Sep-21 4:45

In [...] groups (alternatives) you don't want the |s.
[aeiou] as a regex will match any vowel, for example.

Software rusts. Simon Stephenson, ca 1994. So does this signature. me, 2012

Member 1489067816-Sep-21 3:07

Trying to match a string with many backslashes

16-Sep-21 3:07

I use Regex match to find multiple words in Like mode (start and end point). I do not want the return to include the space as the first position and I do not want the final space to count as valid.

Regular Expression: "\b(?:.Road.|.ous.|.Street.)\b" Must Return: Match:9 length:5 End:13
Text: "have one house free."

Florian Rammler31-Aug-21 1:35

Florian Rammler

31-Aug-21 1:35

Hello there, I have a string that looks like this

XML

\abc\rvr\sad\dqwdwq Some text  \rfdqwdvr\rtgevr\rgwvrr\23rvrv Some text \rffewvr\rfewvr\rvfewrr\rvrwefewv

I want to match the parts of the string that are connected by the backslashes. I partially achieved this with

XML

[\\][A-z0-9]+

but this only matches the first one. How can I match every part with backslashes in this string?

Thanks

modified 31-Aug-21 8:08am.

Re: Trying to match a string with many backslashes

Richard Deeming31-Aug-21 2:55