## Version 2022/08/06
# Fail2Ban filter configuration for authelia

[INCLUDES]
before = common.conf

# Make sure that the HTTP header "X-Forwarded-For" received by Authelia's backend
# only contains a single IP address (the one from the end-user), and not the proxy chain
# (it is misleading: usually, this is the purpose of this header).

[Definition]

# this counts every failed login (wrong username or password) and failed TOTP entry as a failure
failregex = ^.*Unsuccessful (1FA|TOTP|Duo|U2F) authentication attempt by user .*remote_ip="?<HOST>"? stack.*
            (?i)^.*access to .*is not authorized.*remote_ip=<HOST>
            ^.* is banned until .*remote_ip=<HOST> stack.*

# we can ignore debug, info and warning messages as all authentication failures are flagged as level=error by Authelia
ignoreregex = ^.*level=debug.*
              ^.*level=info.*
              ^.*level=warning.*
