fail to ban

Yannick Champs

unread,

Aug 11, 2026, 4:53:05 PM (8 days ago) Aug 11

to Event-Driven Servers

Hello All,

is there a way to ban a tacacs user after X failed password attempts for Y minutes ?

When the user is banned we also have a syslog message send to a syslog server, possible ?

Regards

Marc Huber

unread,

Aug 12, 2026, 1:09:26 PM (8 days ago) Aug 12

to event-driv...@googlegroups.com

Hi Yannick,

the "tacauth_limit" module implements blocking users based on failed authentication attempts for MAVIS-authenticated users. It's documented in https://projects.pro-bono-publico.de/event-driven-servers/doc/mavis.html#AEN796 (but I'm no sure whether that bookmark pointer will be valid after any update).

Syslog notifications aren't implemented, but propagating the blacklisting status back for reporting is a sane idea, I'm looking into that.

Cheers,

Marc

--
You received this message because you are subscribed to the Google Groups "Event-Driven Servers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to event-driven-ser...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/event-driven-servers/849e66f0-5af7-49bf-a5eb-96edfcf52792n%40googlegroups.com.

Marc Huber

unread,

Aug 13, 2026, 1:17:22 PM (7 days ago) Aug 13

to event-driv...@googlegroups.com

Hi Yannick,

I've had some more thoughts about the logging part. You can easily configure this with a suitable syslog filter that checks the user message set by tacauth_limit, e.g.:

script logfilter {
if ("${umessage}" =~ /\(banned for another /) permit
deny
}
log authenlog {
destination = syslog
filter = logfilter
}
authentication log = authenlog

Cheers,

Marc

To view this discussion visit https://groups.google.com/d/msgid/event-driven-servers/c393c39b-2efc-46c9-a266-9bd978f5d956%40googlemail.com.

Reply all

Reply to author

Forward