fail2ban/config/filter.d/apache-fakegooglebot.conf

# Fail2Ban filter for fake Googlebot User Agents

[Definition]

failregex = ^\s*<HOST> \S+ \S+(?: \S+)?\s+\S+ "[A-Z]+ /\S* [^"]*" \d+ \d+ \"[^"]*\" "[^"]*\bGooglebot/[^"]*"

ignoreregex =

datepattern = ^[^\[]*(\[{DATE}\s*\])
              {^LN-BEG}

# DEV Notes:
#
# Author: Lee Clemens
# Thanks: Johannes B. Ullrich, Ph.D.
# Reference: https://isc.sans.edu/forums/diary/When+Google+isnt+Google/15968/
New jail: apache-fakegooglebot Detects fake googlebot user agents in apache access log 2015-02-02 05:42:01 +00:00			`# Fail2Ban filter for fake Googlebot User Agents`

			`[Definition]`

filter.d/apache-fakegooglebot.conf: better, more precise regex and datepattern (closes possible weakness like #3013) 2021-05-11 11:47:48 +00:00			`failregex = ^\s<HOST> \S+ \S+(?: \S+)?\s+\S+ "[A-Z]+ /\S [^"]" \d+ \d+ \"[^"]\" "[^"]\bGooglebot/[^"]"`
New jail: apache-fakegooglebot Detects fake googlebot user agents in apache access log 2015-02-02 05:42:01 +00:00
			`ignoreregex =`

filter.d/apache-fakegooglebot.conf: better, more precise regex and datepattern (closes possible weakness like #3013) 2021-05-11 11:47:48 +00:00			`datepattern = ^[^\[](\[{DATE}\s\])`
more precise date template handling (WARNING: this commit creates possible incompatibilities): - datedetector rewritten more strict as earlier; - default templates can be specified exacter using prefix/suffix syntax (via `datepattern`); - more as one date pattern can be specified using option `datepattern` now (new-line separated); - some default options like `datepattern` can be specified directly in section `[Definition]`, that avoids contrary usage of unnecessarily `[Init]` section, because of performance (each extra section costs time); - option `datepattern` can be specified in jail also (jails without filters); - if first group specified, only this will be cut out from search log-line (e. g.: `^date:[({DATE})]` will cut out only datetime match pattern, and leaves `date:[] failure ip...` for searching in filter); - faster match and fewer searching of appropriate templates (DateDetector.matchTime calls rarer DateTemplate.matchDate now); - standard filters extended with exact prefixed or anchored date templates; template cache introduced (in opposition to default template cache, holds custom templates cached by pattern for possible common usage of same template/regex); 2016-10-07 12:57:45 +00:00			`{^LN-BEG}`
New jail: apache-fakegooglebot Detects fake googlebot user agents in apache access log 2015-02-02 05:42:01 +00:00
			`# DEV Notes:`
			`#`
			`# Author: Lee Clemens`
			`# Thanks: Johannes B. Ullrich, Ph.D.`
			`# Reference: https://isc.sans.edu/forums/diary/When+Google+isnt+Google/15968/`