gitlab.conf

# fail2ban filter configuration for gitlab

# Author: Dimitri Enns

# Inspired by: https://gitlab.com/MiGoller/gitlab-fail2ban-filter

# fail2ban filter configuration for gitlab

[Init]

maxlines = 4

[Definition]

# The relevant log file is in /var/log/gitlab/gitlab-rails/production.log

#Started POST "/users/sign_in" for IP.IP.IP.IP at TIMESTAMP

#Processing by SessionsController#create as HTML

#  Parameters: {"authenticity_token"=>"[FILTERED]", "user"=>{"login"=>"USER_NAME", "password"=>"[FILTERED]", "remember_me"=>"0"}}

#Completed 401 Unauthorized in 9ms (ActiveRecord: 1.3ms | Elasticsearch: 0.0ms | Allocations: 4113)

failregex = ^Started POST \"\/users/sign_in\" for <HOST> at .*<SKIPLINES>.*Parameters: \{\"authenticity_token\".*\"user\"\=\>\{\"login\"\=\>\".*\".*<SKIPLINES>Completed 401 Unauthorized

ignoreregex =