Hi everyone Is there any documentation that covers specific error messages that might appear in an openvpn.log, specifically those that cover authentication failures or that hint at hack attempts/brute force attacks? I am trying to prepare some fail2ban rules, but searching the internet (and this forum) for rules has yielded poor results. A few possible options, always debated. Some examples that I have found: [code] Connection reset, restarting \[[0-9-]{1,2}\] :[0-9]{4,5} TLS Auth Error: Auth Username/Password verification failed for peer [/code] I can of course start with these, but I don't want to expose my network to risk from hack/brute force simply for lack of knowledge of these errors. Any suggestions or additions to the above patterns (with samples log entries if possible) would be very much appreciated. Many thanks, Jel

[quote="jelonki"] Is there any documentation that covers specific error messages that might appear in an openvpn.log, specifically those that cover authentication failures or that hint at hack attempts/brute force attacks? [/quote] Please surf to https://lists.sourceforge.net/lists/listinfo/openvpn-users, subscribe to the mailing list and then re-post your question there. You will get a response from the OpenVPN experts in no time.

Checking openvpn.log for evidence of hack/brute force

jelonki

Hi everyone

Is there any documentation that covers specific error messages that might appear in an openvpn.log, specifically those that cover authentication failures or that hint at hack attempts/brute force attacks?

I am trying to prepare some fail2ban rules, but searching the internet (and this forum) for rules has yielded poor results. A few possible options, always debated.

Some examples that I have found:

        <HOST> Connection reset, restarting \[[0-9-]{1,2}\]
        <HOST>:[0-9]{4,5} TLS Auth Error: Auth Username/Password verification failed for peer

I can of course start with these, but I don't want to expose my network to risk from hack/brute force simply for lack of knowledge of these errors.

Any suggestions or additions to the above patterns (with samples log entries if possible) would be very much appreciated.

Many thanks,
Jel

innogen

jelonki wrote Is there any documentation that covers specific error messages that might appear in an openvpn.log, specifically those that cover authentication failures or that hint at hack attempts/brute force attacks?

Please surf to https://lists.sourceforge.net/lists/listinfo/openvpn-users, subscribe to the mailing list and then re-post your question there.

You will get a response from the OpenVPN experts in no time.