**Background:**
I have the latest version of Phabricator running on a Debian server with LDAP as authentication provider.
**Problem:**
I'd like to secure my server from brute force password guessing attempts through Phabricator, by using fail2ban and Phabricator's access log output.
However, Phabricator's access log has two major issues:
# There is no clear indication in the access log that a web-fronted log-in attempt failed. Phabricator does not send a clear HTTP status code such as 401 as a response for a failed log-in attempt. Right now it's always 200 OK.
# The date output format of `%D` and `%e` cannot be interpreted by fail2ban. Fail2ban would require a source code patch in order to support Phabricator's date format.
**Related problem:**
it is not possible to change `log.access.format` using `bin/config`. It gives the following error message:
> Usage Exception: Config key "log.access.format" is of type "wild". Specify it in JSON.
I had to edit that value manually in the local JSON configuration file.
**Suggested solutions:**
# Add an authentication error response to the access log output. That could be done as HTTP status code 401 or maybe some additional log output for that purpose.
# Give an option for customizing the log output date format.
# ...or change the date format to something fail2ban understands.