title: fail2ban regex for openvpn access server
body: <p>I recently built a personal OpenVPN access server that I use for securing my cell phone when on public wifi.  The VPN piece is working great but I'd like to lock down OpenVPN itself using fail2ban(which is currently in use for ssh on the server).  However, all the fail2ban configurations I can find with Google seem to be for the community edition, not access server.</p>
  
  <p>Access Server doesn't appear to log auth failures to a log file by default, but I got the failed auths to write to the log by adding the following to as.conf</p>
  
  <pre><code>DEBUG_LOGDB=1
  </code></pre>
  
  <p>Now, when I generate a failed login for the web GUI, I get the following in /var/log/openvpnas.log</p>
  
  <pre><code>2018-05-15 03:24:14+0000 [-] LOG ERR: 'LOG_DB RECORD {"username": "daffyduck", "node": "openvpnas2", "service": "WEB_CLIENT", "real_ip": "123.123.123.123", "timestamp": 1526354654, "start_time": 1526354654, "session_id": "lW7IVKadsgfb6NTR74", "auth": 0, "error": "local auth failed: no stored password digest found in authcred attributes: auth/authlocal:35,web/http:1609,web/http:750,web/server:127,web/server:134,xml/authrpc:110,xml/authrpc:164,internet/defer:102,xml/authsess:50,sagent/saccess:86,xml/authrpc:244,xml/authsess:50,xml/authsess:103,auth/authdelegate:308,util/delegate:26,auth/authdelegate:237,util/defer:224,util/defer:246,internet/defer:190,internet/defer:181,internet/defer:323,util/defer:246,internet/defer:190,internet/defer:181,internet/defer:323,util/defer:245,internet/defer:102,auth/authdelegate:61,auth/authdelegate:240,util/delegate:26,auth/authlocal:35,util/error:61,util/error:44"}'
  </code></pre>
  
  <p>However, I'm not sure how to turn that file into a regex/configuration that fail2ban can use to blacklist IP addresses after enough failed authentication requests.</p>
  
  <p>Can someone assist with generating the fail2ban conf file?  Or is there a better way to restrict failed logins on openvpn that doesn't involve fail2ban?</p>
  
  <p>Edit:</p>
  
  <p>The final working regex I settled on with this setup is:</p>
  
  <pre><code>failregex = ^.*LOG ERR.*\"real_ip\": \"&lt;HOST&gt;\".*\"auth\": 0,.*
  </code></pre>