fail2ban/config/filter.d/nginx-botsearch.conf

# Fail2Ban filter to match web requests for selected URLs that don't exist
#

[INCLUDES]

# Load regexes for filtering
before = botsearch-common.conf

[Definition]

failregex = ^<HOST> \- \S+ \[\] \"(GET|POST|HEAD) \/<block> \S+\" 404 .+$
            ^ \[error\] \d+#\d+: \*\d+ (\S+ )?\"\S+\" (failed|is not found) \(2\: No such file or directory\), client\: <HOST>\, server\: \S*\, request: \"(GET|POST|HEAD) \/<block> \S+\"\, .*?$

ignoreregex = 

datepattern = {^LN-BEG}%%ExY(?P<_sep>[-/.])%%m(?P=_sep)%%d[T ]%%H:%%M:%%S(?:[.,]%%f)?(?:\s*%%z)?
              ^[^\[]*\[({DATE})
              {^LN-BEG}

# DEV Notes:
# Based on apache-botsearch filter
# 
# Author: Frantisek Sumsal
Add jail nginx-botsearch Jail blocks requests for predefined non-existent folders. Based on apache-botsearch jail. 2015-01-29 16:57:52 +00:00			`# Fail2Ban filter to match web requests for selected URLs that don't exist`
			`#`

Created botsearch-common.conf File contains variables used in -botsearch filters 2015-02-03 03:25:47 +00:00			`[INCLUDES]`

			`# Load regexes for filtering`
			`before = botsearch-common.conf`

Add jail nginx-botsearch Jail blocks requests for predefined non-existent folders. Based on apache-botsearch jail. 2015-01-29 16:57:52 +00:00			`[Definition]`

Add HEAD method verb to apache-badbots, nginx-badbots 2015-07-07 15:45:40 +00:00			`failregex = ^<HOST> \- \S+ \[\] \"(GET\|POST\|HEAD) \/<block> \S+\" 404 .+$`
			`^ \[error\] \d+#\d+: \\d+ (\S+ )?\"\S+\" (failed\|is not found) \(2\: No such file or directory\), client\: <HOST>\, server\: \S\, request: \"(GET\|POST\|HEAD) \/<block> \S+\"\, .*?$`
Add jail nginx-botsearch Jail blocks requests for predefined non-existent folders. Based on apache-botsearch jail. 2015-01-29 16:57:52 +00:00
			`ignoreregex =`

more precise date template handling (WARNING: this commit creates possible incompatibilities): - datedetector rewritten more strict as earlier; - default templates can be specified exacter using prefix/suffix syntax (via `datepattern`); - more as one date pattern can be specified using option `datepattern` now (new-line separated); - some default options like `datepattern` can be specified directly in section `[Definition]`, that avoids contrary usage of unnecessarily `[Init]` section, because of performance (each extra section costs time); - option `datepattern` can be specified in jail also (jails without filters); - if first group specified, only this will be cut out from search log-line (e. g.: `^date:[({DATE})]` will cut out only datetime match pattern, and leaves `date:[] failure ip...` for searching in filter); - faster match and fewer searching of appropriate templates (DateDetector.matchTime calls rarer DateTemplate.matchDate now); - standard filters extended with exact prefixed or anchored date templates; template cache introduced (in opposition to default template cache, holds custom templates cached by pattern for possible common usage of same template/regex); 2016-10-07 12:57:45 +00:00			`datepattern = {^LN-BEG}%%ExY(?P<_sep>[-/.])%%m(?P=_sep)%%d[T ]%%H:%%M:%%S(?:[.,]%%f)?(?:\s*%%z)?`
			`^[^\[]*\[({DATE})`
			`{^LN-BEG}`
Add jail nginx-botsearch Jail blocks requests for predefined non-existent folders. Based on apache-botsearch jail. 2015-01-29 16:57:52 +00:00
			`# DEV Notes:`
			`# Based on apache-botsearch filter`
			`#`
			`# Author: Frantisek Sumsal`