fail2ban/config/filter.d/squid.conf

# Fail2Ban filter for Squid attempted proxy bypasses
#
#

[Definition]

failregex = ^\s+\d\s<HOST>\s+[A-Z_]+_DENIED/403 .*$
            ^\s+\d\s<HOST>\s+NONE/405 .*$

ignoreregex =

# Author: Daniel Black
ENH: add squid filter 2013-12-10 10:24:37 +00:00			`# Fail2Ban filter for Squid attempted proxy bypasses`
			`#`
			`#`

			`[Definition]`

BF: multiple _ separated values according to http://wiki.squid-cache.org/SquidFaq/SquidLogs#Squid_result_codes. Thanks Steven 2013-12-10 20:44:41 +00:00			`failregex = ^\s+\d\s<HOST>\s+[A-Z_]+_DENIED/403 .*$`
ENH: add squid filter 2013-12-10 10:24:37 +00:00			`^\s+\d\s<HOST>\s+NONE/405 .*$`

ENH: define ignoreregex for all filters explicitly, to avoid warnings (Closes #934) 2015-01-30 15:37:45 +00:00			`ignoreregex =`
ENH: add squid filter 2013-12-10 10:24:37 +00:00
			`# Author: Daniel Black`