LF_HTACCESS not working on LiteSpeed servers

[sfshayne]

It would be great if you can add LF_HTACESS support for LiteSpeed as this feature doesn't seem to be compatible with LSWS servers.

[marcele]

Want to give me a log line sample? I can create a custom rule for you.

[sfshayne]

Want to give me a log line sample? I can create a custom rule for you.

Hi,

Here you go:

[INFO] [ip.add.re.ss:xxxxx:HTTP2-1] Authentication failed with user: 'username'.

xxxxx = random numerical ID

Thanks.

[marcele]

Add to /usr/local/csf/bin/regex.custom.pm . This should block a user for 1 day who has 5 failed attempts.:

Code: Select all

if (($config{LF_HTACCESS}) and ($globlogs{HTACCESS_LOG}{$lgfile}) and ($line =~ /\[INFO\] \[(\S+):.*?\] Authentication failed with user: '(\S*)'.$/)) {
		return ("Failed web page login from $2",$1,"htpasswd","5","80,443","86400");
	}

[sfshayne]

Add to /usr/local/csf/bin/regex.custom.pm . This should block a user for 1 day who has 5 failed attempts.:

Code: Select all

if (($config{LF_HTACCESS}) and ($globlogs{HTACCESS_LOG}{$lgfile}) and ($line =~ /\[INFO\] \[(\S+):.*?\] Authentication failed with user: '(\S*)'.$/)) {
		return ("Failed web page login from $2",$1,"htpasswd","5","80,443","86400");
	}

Thanks but that didn't work for me. I'm trying to make this work on a cPanel server if that makes a difference.

[marcele]

I need to know the exact unaltered log line. Please include it in code brackets. The example you posted posted was very different than what other lightspeed users have posted:
https://www.litespeedtech.com/support/f ... logs.1935/

[sfshayne]

I need to know the exact unaltered log line. Please include it in code brackets. The example you posted posted was very different than what other lightspeed users have posted:
https://www.litespeedtech.com/support/f ... logs.1935/

Hi, here it is but with the IP address redacted.

Code: Select all

2015-12-02 23:17:35.845 [INFO] [IP.ADD.RE.SS:50364:HTTP2-7] Authentication failed with user: 'username'.

[marcele]

This should work now:

Code: Select all

if (($config{LF_HTACCESS}) and ($globlogs{HTACCESS_LOG}{$lgfile}) and ($line =~ /\[INFO\] \[(\S+):\d+\S+\] Authentication failed with user: '(\S*)'.$/)) {
		return ("Failed web page login from $2",$1,"htpasswd","5","80,443","86400");
	}

Example:
https://regex101.com/r/mA6nA7/2

[sfshayne]

This should work now:

Code: Select all

if (($config{LF_HTACCESS}) and ($globlogs{HTACCESS_LOG}{$lgfile}) and ($line =~ /\[INFO\] \[(\S+):\d+\S+\] Authentication failed with user: '(\S*)'.$/)) {
		return ("Failed web page login from $2",$1,"htpasswd","5","80,443","86400");
	}

Example:
https://regex101.com/r/mA6nA7/2

Perfect! Thanks!