view mod_log_auth/README.markdown @ 4575:5b4f43b90766

mod_measure_malloc: port to most recent trunk statistics API
author Jonas Schäfer <>
date Tue, 25 May 2021 19:01:54 +0200
parents a47520a2c59d
line wrap: on
line source

- 'Stage-Stable'
summary: Log failed authentication attempts with their IP address


Prosody doesn't write IP addresses to its log file by default for
privacy reasons (unless debug logging is enabled).

This module enables logging of the IP address in a failed authentication
attempt so that those trying to break into accounts for example can be

fail2ban configuration

fail2ban is a utility for monitoring log files and automatically
blocking "bad" IP addresses at the firewall level.

With this module enabled in Prosody you can use the following example
configuration for fail2ban:

    # /etc/fail2ban/filter.d/prosody-auth.conf
    # Fail2Ban configuration file for prosody authentication
    failregex = Failed authentication attempt \(not-authorized\) for user .* from IP: <HOST>
    ignoreregex =

And at the appropriate place (usually the bottom) of
/etc/fail2ban/jail.conf add these lines:

    enabled = true
    port    = 5222
    filter  = prosody-auth
    logpath = /var/log/prosody/prosody*.log
    maxretry = 6


  ------- --------------
  trunk   Works
  0.9     Works
  0.8     Doesn't work
  ------- --------------