web server logging?

[snagglewest]

Sub, I poked around a bit but can't find an answer.  Does the web server piece do any sort of logging?  I'm just looking for failed login attempts so I can use fail2ban.

[Graham]

Does the web server piece do any sort of logging?  I'm just looking for failed login attempts so I can use fail2ban.

NextPVR Server V5 logs everything in nrecord.log ... there is no web.log in V5.

[sub]

Yep, what he said - this stuff is in nrecord.log.

[snagglewest]

Sub, I found the session indication of a log-out and a valid log-in but a failed attempt eludes me, what should I be looking for? In the off chance it doesn't log, would you mind adding something?

[mvallevand]

I would just use fail2ban defaults, it isn't designed for API based login.

Martin

[snagglewest]

I get it, but fail2ban needs some indication of a failed attempt in the log to parse. I have yet been able to find any mention of a failed attempt in the log hence the question.

[mvallevand]

It doesn't fail, it is allowed access to index.html then the NextPVR API takes over. fail2ban will block the IP on too many attempt to open the first page.

If you want real control just run nginx in front of NextPVR.

Martin

[snagglewest]

We're talking semantics here. Npvr is obviously smart enough to know if a log-in attempt was successful or unsuccessful as the successful log-in is already logged, I'm just looking for some indication in the log if the attempt was unsuccessful. I seldom expose Npvr to the world, maybe 2-3 times a year for a few days at a time while I'm traveling. I'm not looking to make this any more complicated with a nginx/apache reverse proxy, if there was an indication in the log fail2ban would be dead simple.

[sub]

I've added a simple "web login failed (192.168.1.33)" type message to nrecord.log for the next build.

[snagglewest]

Thank you Sub!