0

I am receiving a number of apache not found or unable to stat and would like to block these IP addresses using Fail2Ban.

[Fri Feb 28 03:36:51.816955 2014] [:error] [pid 29027] [client XX.X.XX.XX:1432] script '/var/www/wp-login.php' not found or unable to stat, referer: http://redstonewither.com/wp-login.php

I have the Fail2Ban filter called apache-noscript enabled which includes the following failregex:

failregex = [[]client HOST[]] (File does not exist|script not found or unable to stat): /\S*(\.php|\.asp|\.exe|\.pl)

I think the above is blocking these:

[Wed Feb 26 21:58:38.695327 2014] [:error] [pid 1390] [client XX.XX.XXX.XXX:36422] script '/var/www/wp-login.php' not found or unable to stat

Would I be correct in saying the following failregex would block the referrer ones?

failregex = [[]client HOST[]] (File does not exist|script not found or unable to stat, referrer:): /\S*(\.php|\.asp|\.exe|\.pl)
4
  • Take a look at this Q/A. There is a brief explanation on how to test your failregex configuration.
    – dawud
    Feb 27 '14 at 21:16
  • The link provided has nothing to do with my issue.
    – daygle
    Feb 27 '14 at 21:21
  • IMHO, the link provided does show how to test your regexes, and therefore should be valuable information when trying to answer: "Would I be correct in saying the following failregex would block the referrer ones?".
    – dawud
    Feb 27 '14 at 21:25
  • @daygle: You need to read the answer to the linked question, it provides useful information on how to test your regex against your log entries.
    – user9517
    Feb 27 '14 at 21:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.