2013-10-30 13:02:59 +00:00
|
|
|
# Fail2Ban apache-auth filter
|
2006-07-17 19:26:14 +00:00
|
|
|
#
|
|
|
|
|
|
2013-06-11 18:56:25 +00:00
|
|
|
[INCLUDES]
|
|
|
|
|
|
|
|
|
|
# Read common prefixes. If any customizations available -- read them from
|
2013-10-30 13:02:59 +00:00
|
|
|
# apache-common.local
|
2013-06-11 18:56:25 +00:00
|
|
|
before = apache-common.conf
|
|
|
|
|
|
2006-07-16 21:35:08 +00:00
|
|
|
[Definition]
|
|
|
|
|
|
2013-10-30 13:02:59 +00:00
|
|
|
|
2016-12-23 21:57:24 +00:00
|
|
|
failregex = ^%(_apache_error_client)s (AH(01797|01630): )?client denied by server configuration
|
|
|
|
|
^%(_apache_error_client)s (AH01617: )?user \S* authentication failure
|
|
|
|
|
^%(_apache_error_client)s (AH01618: )?user \S* not found
|
|
|
|
|
^%(_apache_error_client)s (AH01614: )?client used wrong authentication scheme
|
|
|
|
|
^%(_apache_error_client)s (AH\d+: )?Authorization of user \S* to access .* failed
|
|
|
|
|
^%(_apache_error_client)s (AH0179[24]: )?(Digest: )?user \S*: password mismatch
|
|
|
|
|
^%(_apache_error_client)s (AH0179[01]: |Digest: )user `\S*' in realm `.+' (not found|denied by provider)
|
|
|
|
|
^%(_apache_error_client)s (AH01631: )?user \S*: authorization failure
|
2013-11-18 23:27:55 +00:00
|
|
|
^%(_apache_error_client)s (AH01775: )?(Digest: )?invalid nonce .* received - length is not \S+(, referer: \S+)?\s*$
|
|
|
|
|
^%(_apache_error_client)s (AH01788: )?(Digest: )?realm mismatch - got `.*?' but expected `.+'(, referer: \S+)?\s*$
|
2016-12-23 21:57:24 +00:00
|
|
|
^%(_apache_error_client)s (AH01789: )?(Digest: )?unknown algorithm `
|
|
|
|
|
^%(_apache_error_client)s (AH01793: )?invalid qop `
|
2013-11-18 23:27:55 +00:00
|
|
|
^%(_apache_error_client)s (AH01777: )?(Digest: )?invalid nonce .*? received - user attempted time travel(, referer: \S+)?\s*$
|
2013-10-30 13:02:59 +00:00
|
|
|
|
|
|
|
|
ignoreregex =
|
|
|
|
|
|
|
|
|
|
# DEV Notes:
|
|
|
|
|
#
|
2013-07-11 21:39:18 +00:00
|
|
|
# This filter matches the authorization failures of Apache. It takes the log messages
|
|
|
|
|
# from the modules in aaa that return HTTP_UNAUTHORIZED, HTTP_METHOD_NOT_ALLOWED or
|
|
|
|
|
# HTTP_FORBIDDEN and not AUTH_GENERAL_ERROR or HTTP_INTERNAL_SERVER_ERROR.
|
|
|
|
|
#
|
2013-07-28 22:59:25 +00:00
|
|
|
# An unauthorized response 401 is the first step for a browser to instigate authentication
|
|
|
|
|
# however apache doesn't log this as an error. Only subsequent errors are logged in the
|
|
|
|
|
# error log.
|
2013-07-11 21:39:18 +00:00
|
|
|
#
|
|
|
|
|
# Source:
|
|
|
|
|
#
|
|
|
|
|
# By searching the code in http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/*
|
|
|
|
|
# for ap_log_rerror(APLOG_MARK, APLOG_ERR and examining resulting return code should get
|
|
|
|
|
# all of these expressions. Lots of submodules like mod_authz_* return back to mod_authz_core
|
|
|
|
|
# to return the actual failure.
|
2013-07-17 14:36:17 +00:00
|
|
|
#
|
2016-12-23 21:57:24 +00:00
|
|
|
# Note that URI can contain spaces.
|
|
|
|
|
#
|
2013-07-17 14:36:17 +00:00
|
|
|
# See also: http://wiki.apache.org/httpd/ListOfErrors
|
2013-08-19 21:33:35 +00:00
|
|
|
# Expressions that don't have tests and aren't common.
|
|
|
|
|
# more be added with https://issues.apache.org/bugzilla/show_bug.cgi?id=55284
|
|
|
|
|
# ^%(_apache_error_client)s (AH01778: )?user .*: nonce expired \([\d.]+ seconds old - max lifetime [\d.]+\) - sending new nonce\s*$
|
|
|
|
|
# ^%(_apache_error_client)s (AH01779: )?user .*: one-time-nonce mismatch - sending new nonce\s*$
|
|
|
|
|
# ^%(_apache_error_client)s (AH02486: )?realm mismatch - got `.*' but no realm specified\s*$
|
2013-07-17 14:36:17 +00:00
|
|
|
#
|
2013-11-18 23:27:55 +00:00
|
|
|
# referer is always in error log messages if it exists added as per the log_error_core function in server/log.c
|
|
|
|
|
#
|
2013-10-30 13:02:59 +00:00
|
|
|
# Author: Cyril Jaquier
|
|
|
|
|
# Major edits by Daniel Black
|
