-1
votes
2answers
105 views

Fail2Ban Regex - Joomla / PHP5-FPM

i can't get a regex for fail2ban to work. I want to match the following: [Tue Jun 24 10:22:14.528987 2014] [fcgid:warn] [pid 22526:tid 139757615011584] [client IP:PORT] mod_fcgid: stderr: user admin ...
1
vote
1answer
149 views

fail2ban-regex matches with strings, but not with log and conf files, why?

If I run fail2ban-regex '31.22.105.115 - - [11/Apr/2014:18:09:54 +0100] "GET /admin/config.php HTTP/1.0" 301 573 "-" "-"' '^<HOST> - - (?:\[[^]]*\] ...
1
vote
1answer
482 views

fail2ban bad bots apache access log regex

Trying to block some bad bots using fail2ban reading Apache access log and stuck setting up correct regex. The line I want to match in the access log is: 5.10.83.65 - - [18/Mar/2014:09:06:38 +0400] ...
1
vote
1answer
92 views

fail2ban jail not working properly

I'm trying to block non-available script requests to nginx with fail2ban. # Noscript filter /etc/fail2ban/filter.d/nginx-noscript.conf: # # Block IPs trying to execute scripts such as .php, .pl, ...
2
votes
1answer
61 views

Use of backreferences in fail2ban filters possible?

From time to time, I see collections of suspect "File not found" errors in my Apache logs, basically using the pattern File does not exist: /var/www/file, referer: http://my.server.com/file In ...
2
votes
1answer
2k views

How do I format this regex so it will work in fail2ban?

I've just installed fail2ban on my CentOS server in response to an SSH brute force attempt. The default regular expressions in fail2ban's sshd.conf file do not match any entries in audit.log, which ...
3
votes
1answer
2k views

Fail2Ban SASL Filter Misses Failed Logins

I am using fail2ban on my mail server. I discovered this morning that there were some 5000 failed login attempts (in the course of 1 hour) via SMTP that didn't get picked up by my sasl filter. Here ...
0
votes
2answers
619 views

fail2ban regex to catch dovecot log entry?

Am trying to write a fail2ban regex that catches anyone who tries the user-id "administrador". For example, this log entry: Jan 2 09:55:01 mail2 dovecot: pop3-login: Disconnected: ...
2
votes
2answers
812 views

fail2ban regex that uses less CPU?

Using fail2ban, I want to ban these spammers who are sending to a spamtrap address: Oct 27 09:04:22 si68 postfix/smtpd[3240]: NOQUEUE: reject: RCPT from unknown[117.197.114.222]: 550 5.7.1 ...
1
vote
1answer
317 views

What regular expression can I use to identify invalid file requests in nginx logs?

I need help configuring a regular expression for fail2ban. I use my web server primarily for simple podcast file hosting but I see a lot of invalid requests for php, asp, and pl files in the logs. ...
1
vote
1answer
291 views

Basic Apache Log Regex

I'm struggling to match Fail2Ban's failregex on Apache logs using only the HTTP return codes. The log format I'm using is below and in that example it's the field showing "200". As long as the other ...