francescor93

Following is a simple fail2ban jail for Mosquitto authentication.

When an authentication attempt fails, Mosquitto writes three lines like these to his log file:
---
<TIMESTAMP>: New connection from <HOST> on port <PORT>.
<TIMESTAMP>: Sending CONNACK to <HOST>
<TIMESTAMP>: Socket error on client <unknown>, disconnecting.
---
This filter looks for these three lines to get the host and allow you to ban it.