2020-06-06 17:51:46 +00:00
|
|
|
# Fail2Ban filter to match bad requests to nginx
|
|
|
|
|
#
|
|
|
|
|
|
|
|
|
|
[Definition]
|
|
|
|
|
|
|
|
|
|
# The request often doesn't contain a method, only some encoded garbage
|
2020-06-21 16:24:09 +00:00
|
|
|
# This will also match requests that are entirely empty
|
|
|
|
|
failregex = ^<HOST> - \S+ \[\] "[^"]*" 400
|
2020-06-06 17:51:46 +00:00
|
|
|
|
|
|
|
|
datepattern = {^LN-BEG}%%ExY(?P<_sep>[-/.])%%m(?P=_sep)%%d[T ]%%H:%%M:%%S(?:[.,]%%f)?(?:\s*%%z)?
|
|
|
|
|
^[^\[]*\[({DATE})
|
|
|
|
|
{^LN-BEG}
|
|
|
|
|
|
2021-02-12 08:29:03 +00:00
|
|
|
journalmatch = _SYSTEMD_UNIT=nginx.service + _COMM=nginx
|
|
|
|
|
|
2020-06-06 17:51:46 +00:00
|
|
|
# Author: Jan Przybylak
|
