ConfigServer Community Forum

This should work now: if (($config{LF_HTACCESS}) and ($globlogs{HTACCESS_LOG}{$lgfile}) and ($line =~ /\[INFO\] \[(\S+):\d+\S+\] Authentication failed with user: '(\S*)'.$/)) { return ("Failed web page login from $2",$1,"htpasswd","5","80,443","86400&quo...

I need to know the exact unaltered log line. Please include it in code brackets. The example you posted posted was very different than what other lightspeed users have posted: https://www.litespeedtech.com/support/forum/threads/authentication-failed-with-user-in-logs.1935/ Hi, here it is but with t...

Add to /usr/local/csf/bin/regex.custom.pm . This should block a user for 1 day who has 5 failed attempts.: if (($config{LF_HTACCESS}) and ($globlogs{HTACCESS_LOG}{$lgfile}) and ($line =~ /\[INFO\] \[(\S+):.*?\] Authentication failed with user: '(\S*)'.$/)) { return ("Failed web page login from...

marcele wrote:Want to give me a log line sample? I can create a custom rule for you.

Hi,

Here you go:

[INFO] [ip.add.re.ss:xxxxx:HTTP2-1] Authentication failed with user: 'username'.

xxxxx = random numerical ID

Thanks.

It would be great if you can add LF_HTACESS support for LiteSpeed as this feature doesn't seem to be compatible with LSWS servers.