fail2ban/config/filter.d/squid.conf

# Fail2Ban filter for Squid attempted proxy bypasses
#
#

[Definition]

failregex = ^\s+\d\s<HOST>\s+[A-Z_]+_DENIED/403 .*$
            ^\s+\d\s<HOST>\s+NONE/405 .*$

ignoreregex =

datepattern = {^LN-BEG}Epoch
              {^LN-BEG}

# Author: Daniel Black
ENH: add squid filter 2013-12-10 10:24:37 +00:00			`# Fail2Ban filter for Squid attempted proxy bypasses`
			`#`
			`#`

			`[Definition]`

BF: multiple _ separated values according to http://wiki.squid-cache.org/SquidFaq/SquidLogs#Squid_result_codes. Thanks Steven 2013-12-10 20:44:41 +00:00			`failregex = ^\s+\d\s<HOST>\s+[A-Z_]+_DENIED/403 .*$`
ENH: add squid filter 2013-12-10 10:24:37 +00:00			`^\s+\d\s<HOST>\s+NONE/405 .*$`

ENH: define ignoreregex for all filters explicitly, to avoid warnings (Closes #934) 2015-01-30 15:37:45 +00:00			`ignoreregex =`
ENH: add squid filter 2013-12-10 10:24:37 +00:00
more precise date template handling (WARNING: this commit creates possible incompatibilities): - datedetector rewritten more strict as earlier; - default templates can be specified exacter using prefix/suffix syntax (via `datepattern`); - more as one date pattern can be specified using option `datepattern` now (new-line separated); - some default options like `datepattern` can be specified directly in section `[Definition]`, that avoids contrary usage of unnecessarily `[Init]` section, because of performance (each extra section costs time); - option `datepattern` can be specified in jail also (jails without filters); - if first group specified, only this will be cut out from search log-line (e. g.: `^date:[({DATE})]` will cut out only datetime match pattern, and leaves `date:[] failure ip...` for searching in filter); - faster match and fewer searching of appropriate templates (DateDetector.matchTime calls rarer DateTemplate.matchDate now); - standard filters extended with exact prefixed or anchored date templates; template cache introduced (in opposition to default template cache, holds custom templates cached by pattern for possible common usage of same template/regex); 2016-10-07 12:57:45 +00:00			`datepattern = {^LN-BEG}Epoch`
			`{^LN-BEG}`

ENH: add squid filter 2013-12-10 10:24:37 +00:00			`# Author: Daniel Black`