I need to limit POST requests with Fail2ban for this type of log:
But not block the requests that are:
"POST /subscribers/*" i.e. "POST /subscribers/18"
Is it possible to do with fail2ban? So far I've tried the following jail "subscribers.conf":
[Definition] failregex = ^<HOST> -.*POST /subscribers ignoreregex = ^<HOST> -.*POST /subscribers/*
But due to the ignoreregex, other requests also being ignored. Any help appreciated!
[DEFAULT] ignoreip = 127.0.0.1/8 mta = mail destemail = root sendername = Fail2BanAlerts findtime = 3600 bantime = 6000 #Send mail on all jails: action = %(action_mwl)s [subscribers] enabled = true port = http,https filter = subscribers logpath = /var/log/nginx/access.log maxretry = 3