I need help configuring a regular expression for fail2ban. I use my web server primarily for simple podcast file hosting but I see a lot of invalid requests for php, asp, and pl files in the logs.
I'd like to configure fail2ban to look for invalid file requests of these types in the logs.
At one point, I had the following regex strings setup for apache:
[client ] (No such file or directory|script not found or unable to stat): /\S*(php|mysql|.asp|.exe|.pl)
[client ] script '/\S*(.php|.asp|.exe|.pl)\S*' not found or unable to stat *$
This obviously doesn't work for nginx logs. Here's an excerpt of a bad file request (I've changed the paths and IPs):
2011/05/14 20:38:20 [error] 5349#0: *828 open() "/example/path/htdocs/administrator.php" failed (2: No such file or directory), client: 18.104.22.168, server: example.server.com, request: "GET administrator.php HTTP/1.1", host: "example.server.com"
Could I get some help crafting a revised regex string to catch these types of errors? I'd like to reiterate that I don't host any php or asp files so I'm not too concerned about the potential false positive risk here.