From b7fccafeebc639746d2bd82042d28f4ef0f24648 Mon Sep 17 00:00:00 2001
From: Enrico204 <enrico204@gmail.com>
Date: Mon, 10 Aug 2015 15:13:49 -0400
Subject: [PATCH] Added better logging for fail2ban
---
src/site/setup_fail2ban.mkd | 20 ++++++++++++++++++++
build.xml | 1 +
src/main/java/com/gitblit/transport/ssh/UsernamePasswordAuthenticator.java | 2 +-
3 files changed, 22 insertions(+), 1 deletions(-)
diff --git a/build.xml b/build.xml
index 8544573..65fc043 100644
--- a/build.xml
+++ b/build.xml
@@ -513,6 +513,7 @@
<page name="bugtraq" src="setup_bugtraq.mkd" />
<page name="mirrors" src="setup_mirrors.mkd" />
<page name="scaling" src="setup_scaling.mkd" />
+ <page name="fail2ban" src="setup_fail2ban.mkd" />
<divider />
<page name="Gitblit as a viewer" src="setup_viewer.mkd" />
</menu>
diff --git a/src/main/java/com/gitblit/transport/ssh/UsernamePasswordAuthenticator.java b/src/main/java/com/gitblit/transport/ssh/UsernamePasswordAuthenticator.java
index c4e69dc..d7c4fe5 100644
--- a/src/main/java/com/gitblit/transport/ssh/UsernamePasswordAuthenticator.java
+++ b/src/main/java/com/gitblit/transport/ssh/UsernamePasswordAuthenticator.java
@@ -57,7 +57,7 @@
return true;
}
- log.warn("could not authenticate {} for SSH using the supplied password", username);
+ log.warn("could not authenticate {} ({}) for SSH using the supplied password", username, client.getRemoteAddress());
return false;
}
}
diff --git a/src/site/setup_fail2ban.mkd b/src/site/setup_fail2ban.mkd
new file mode 100644
index 0000000..928f7a8
--- /dev/null
+++ b/src/site/setup_fail2ban.mkd
@@ -0,0 +1,20 @@
+## Configure fail2ban for Gitblit-SSH
+
+This procedure is based on a Debian installation of [fail2ban](http://www.fail2ban.org/), but it should works in any installation.
+
+First, create a new filter file `gitblit.conf` in filter directory (Debian: `/etc/fail2ban/filter.d/`) or into `filter.conf` file. Here an example:
+
+ [Definition]
+ failregex = could not authenticate .*? \(/<HOST>:[0-9]*\) for SSH using the supplied password$
+ ignoreregex =
+
+Then edit `jail.conf` to add "gitblit" service (Debian: `/etc/fail2ban/jail.conf`). For example:
+
+ [gitblit]
+ enabled = true
+ port = 22
+ protocol = tcp
+ filter = gitblit
+ logpath = /var/log/gitblit.log
+
+Restart fail2ban to apply (Debian: `/etc/init.d/fail2ban restart`).
--
Gitblit v1.9.1