I have been banging my head all day trying to match my regex filter to my access.log with no luck. I have installed fail2ban on a gentoo server and its running fine (i manually baned my own IP and it works) but fail2ban regex fails and return 0 results with filters even my site has heavyload attack right now and last coupleof days.
by the way i dont use iptables software on my server (do i need to install one in order for fail2ban to work?) i guess fail2ban cant read my logformat or my time format, i tried to tweak everything but no luck, any help is very very appreciated
Here is my jail.local
[INCLUDES]
before = paths-common.conf
[DEFAULT]
action=%(action_mwl)s
ignoreip = 127.0.0.1/8 192.168.99.25
ignorecommand =
bantime = 86400
findtime = 300
backend = gamin
[wp-login]
enabled = true
filter = wp-login
banaction=iptables-allports
logpath = /var/log/nginx/localhost*access_log
bantime = 7200
maxretry = 1
[nginx-nohome]
enabled=true
port=http,https
filter=nginx-nohome
logpath=/var/log/nginx/localhost.error.log
bantime=86400
maxretry=2
[nginx-dos]
enabled = true
port = http,8090,8080
filter = nginx-dos
logpath = /var/log/nginx/localhost.access*log
findtime = 30
bantime = 172800
maxretry = 140
[nginx-login]
enabled = true
filter = nginx-login
action = iptables-multiport[name=NoLoginFailures, port="http,https"]
logpath = /var/log/messages
bantime = 7200
maxretry = 6
[nginx-req-limit]
enabled = true
filter = nginx-req-limit
action = iptables-multiport[name=ReqLimit, port="http,https", protocol=tcp]
logpath = /var/log/nginx/localhost.access*log
findtime = 600
bantime = 7200
maxretry = 10
and here is my filters:
[Definition]i
failregex = limiting requests, excess:.* by zone.*client: <HOST>
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
~
[Definition]
failregex = ^<HOST> -.*GET */wp-login* HTTP/1\.."
ignoreregex =
#
[Definition]
failregex = ^<HOST> -.*GET.*(\.php|\.asp|\.exe|\.pl|\.cgi|\scgi)
ignoreregex =
[Definition]
failregex = ^<HOST> -.*GET .*/~.*
ignoreregex =
~
On nginx side, this is my log format syntax and output:
log format
log_format main
'[$time_local] - $remote_addr '
'"$request" $status $bytes_sent '
'"$http_referer" "$http_user_agent" ';
accesslog output:
[01/Oct/2015:09:15:52 +0800] - 60.18.17.206, 113.21.15.23 "POST/httprl_async_function_callback?count=121 HTTP/1.1" 200 1351 "-" "Drupal (+http://drupal.org/)" "-"
errorlog format:
2015/09/22 00:04:06 [error] 7418#0: *287 FastCGI sent in stderr: "Primary scriptunknown", client: 192.168.99.76, server: www.sams.com, request: "GET/city HTTP/1.0", host: "www.sams.com"
UPDATE: My site does not use wordpress but i am getting millions of wordpress related link link wp-login.php that i want to block, there are many agressive malicious search bots, ads bots, spider also that breaks my server, i want to block