From a9fa3cb83f90473f5e103ca9d12e33762d87fb4a Mon Sep 17 00:00:00 2001
From: KiekerJan <kiekerjan@users.noreply.github.com>
Date: Wed, 29 Oct 2025 20:26:47 +0100
Subject: [PATCH] Update Nextcloud filter for fail2ban

---
 conf/fail2ban/filter.d/miab-owncloud.conf | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/conf/fail2ban/filter.d/miab-owncloud.conf b/conf/fail2ban/filter.d/miab-owncloud.conf
index 709f8bac..0827cff8 100644
--- a/conf/fail2ban/filter.d/miab-owncloud.conf
+++ b/conf/fail2ban/filter.d/miab-owncloud.conf
@@ -3,6 +3,8 @@
 before = common.conf
 
 [Definition]
-datepattern = %%Y-%%m-%%d %%H:%%M:%%S
-failregex=Login failed: .*Remote IP: '<HOST>[\)']
-ignoreregex =
+_groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)
+failregex = ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
+            ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Trusted domain error.
+datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"
+