Every night bots try to penetrate my Apache Server:
/var/log/apache2/error.log
Output:
[Mon Dec 30 02:55:39.098671 2019] [php7:error] [pid 14930] [client xxx.xxx.xxx.xxx:62420] script '/var/www/html/test.php' not found or unable to stat
I would have expected fail2ban to catch this because there is a filter for it: apache-noscript.conf
[Definition]
failregex = ^%(_apache_error_client)s ((AH001(28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): /\S*(php([45]|[.-]cgi)?|\.asp|\.exe|\.pl)(, referer: \S+)?\s*$
^%(_apache_error_client)s script '/\S*(php([45]|[.-]cgi)?|\.asp|\.exe|\.pl)\S*' not found or unable to stat(, referer: \S+)?\s*$
The default jail.conf says per default this:
[apache-noscript]
port = http,https
logpath = %(apache_error_log)s
Does anyone have an idea why fail2ban still does not block access?