I need to limit POST requests with Fail2ban for this type of log:
"POST /subscribers"
But not block the requests that are:
"POST /subscribers/*" i.e. "POST /subscribers/18"
Is it possible to do with fail2ban? So far I've tried the following jail "subscribers.conf":
[Definition]
failregex = ^<HOST> -.*POST /subscribers
ignoreregex = ^<HOST> -.*POST /subscribers/*
But due to the ignoreregex, other requests also being ignored. Any help appreciated!
Jail.local file:
[DEFAULT]
ignoreip = 127.0.0.1/8
mta = mail
destemail = root
sendername = Fail2BanAlerts
findtime = 3600
bantime = 6000
#Send mail on all jails: action = %(action_mwl)s
[subscribers]
enabled = true
port = http,https
filter = subscribers
logpath = /var/log/nginx/access.log
maxretry = 3
failregex = ^<HOST> -.*POST /subscribers$
POST /subscribers