From c1843b3e49dafb0b4b1e5a04ade02174ba5b226a Mon Sep 17 00:00:00 2001 From: Finn Stutzenstein Date: Fri, 23 Oct 2026 19:42:53 +0000 Subject: [PATCH] Note that fail2ban depends on the order of the audit fields Co-Authored-By: Claude Opus 5.5 --- max/audit.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/max/audit.py b/max/audit.py index 27740c4..1fa836b 100644 --- a/max/audit.py +++ b/max/audit.py @@ -6,6 +6,9 @@ def audit(event, actor=None, target=None, **fields): Logs a security relevant event as one line with the message "audit". actor is the acting user, None for anonymous requests. target is the affected user, if any. """ + # The order of the first fields is fixed: fail2ban matches + # 'audit event=… actor_user_id=… actor_email=… ip=""' (filter max.conf on the VPS). + # Change the filter when changing the order or the names. values = dict( event=event, actor_user_id=actor.id if actor is not None else None,