From c020896e5db61f0a0b3bf53f7d96723e693d3ead Mon Sep 17 00:00:00 2001
From: KiekerJan <kiekerjan@users.noreply.github.com>
Date: Fri, 2 Jan 2026 22:14:08 +0100
Subject: [PATCH] Update Nextcloud filter for fail2ban (#2539)

---
 conf/fail2ban/filter.d/miab-owncloud.conf | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/conf/fail2ban/filter.d/miab-owncloud.conf b/conf/fail2ban/filter.d/miab-owncloud.conf
index 709f8bac..0827cff8 100644
--- a/conf/fail2ban/filter.d/miab-owncloud.conf
+++ b/conf/fail2ban/filter.d/miab-owncloud.conf
@@ -3,6 +3,8 @@
 before = common.conf
 
 [Definition]
-datepattern = %%Y-%%m-%%d %%H:%%M:%%S
-failregex=Login failed: .*Remote IP: '<HOST>[\)']
-ignoreregex =
+_groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)
+failregex = ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
+            ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Trusted domain error.
+datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"
+