I have been banging my head all day trying to match my regex filter to my access.log with no luck. I have installed fail2ban on a gentoo server and its running fine (i manually baned my own IP and it works) but fail2ban regex fails and return 0 results with filters even my site has heavyload attack right now and last coupleof days.
by the way i dont use iptables software on my server (do i need to install one in order for fail2ban to work?) i guess fail2ban cant read my logformat or my time format, i tried to tweak everything but no luck, any help is very very appreciated
Here is my jail.local
[INCLUDES] before = paths-common.conf [DEFAULT] action=%(action_mwl)s ignoreip = 127.0.0.1/8 192.168.99.25 ignorecommand = bantime = 86400 findtime = 300 backend = gamin [wp-login] enabled = true filter = wp-login banaction=iptables-allports logpath = /var/log/nginx/localhost*access_log bantime = 7200 maxretry = 1 [nginx-nohome] enabled=true port=http,https filter=nginx-nohome logpath=/var/log/nginx/localhost.error.log bantime=86400 maxretry=2 [nginx-dos] enabled = true port = http,8090,8080 filter = nginx-dos logpath = /var/log/nginx/localhost.access*log findtime = 30 bantime = 172800 maxretry = 140 [nginx-login] enabled = true filter = nginx-login action = iptables-multiport[name=NoLoginFailures, port="http,https"] logpath = /var/log/messages bantime = 7200 maxretry = 6 [nginx-req-limit] enabled = true filter = nginx-req-limit action = iptables-multiport[name=ReqLimit, port="http,https", protocol=tcp] logpath = /var/log/nginx/localhost.access*log findtime = 600 bantime = 7200 maxretry = 10
and here is my filters:
[Definition]i failregex = limiting requests, excess:.* by zone.*client: <HOST> # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # ignoreregex = ~ [Definition] failregex = ^<HOST> -.*GET */wp-login* HTTP/1\.." ignoreregex = # [Definition] failregex = ^<HOST> -.*GET.*(\.php|\.asp|\.exe|\.pl|\.cgi|\scgi) ignoreregex = [Definition] failregex = ^<HOST> -.*GET .*/~.* ignoreregex = ~
On nginx side, this is my log format syntax and output:
log_format main '[$time_local] - $remote_addr ' '"$request" $status $bytes_sent ' '"$http_referer" "$http_user_agent" ';
[01/Oct/2015:09:15:52 +0800] - 188.8.131.52, 184.108.40.206 "POST/httprl_async_function_callback?count=121 HTTP/1.1" 200 1351 "-" "Drupal (+http://drupal.org/)" "-"
2015/09/22 00:04:06 [error] 7418#0: *287 FastCGI sent in stderr: "Primary scriptunknown", client: 192.168.99.76, server: www.sams.com, request: "GET/city HTTP/1.0", host: "www.sams.com"
UPDATE: My site does not use wordpress but i am getting millions of wordpress related link link wp-login.php that i want to block, there are many agressive malicious search bots, ads bots, spider also that breaks my server, i want to block