So i am trying to rate limit POST requests on my server. I have looked around and tried every permutation of strings that i can find on the internet.
this is my jail.local apache conf
[apache-postUsHttp] enabled = true port = http,https filter = apache-postflood logpath = /var/log/apache2/other_vhosts_access.log findtime = 30 bantime = 3600 maxretry = 10
and here you have the apache-postflood.conf filter
# Fail2Ban configuration file # # # $Revision: 1 $ # [Definition] # Option: failregex # Notes.: Regexp to catch known spambots and software alike. Please verify # that it is your intent to block IPs which were driven by # abovementioned bots. # Values: TEXT # failregex = ^<HOST>.*"POST.* # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # ignoreregex =
here is an example access post log.
my.tld:80 x.x.x.x - - [25/Aug/2016:05:53:52 -0400] "POST /location/of/file.php HTTP/1.1" 302 300 "http://my.tld/" "Mozilla/5.0 (iPhone; CPU iPhone OS 9_3_4 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Version/9.0 Mobile/13G35 Safari/601.1"
i ahve also tried the following failregex = ^ -.* "POST.*
and a lot of other slight variations. but no matter what i do i get no filter notices / infos in my fail2ban logs.
i know that the timespamps are parsing and that it is reading the log, because when i turn on debug loggin it is definately loggin it all.