github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

filter.d/apache-noscript.conf: extended to match "Primary script unknown", got from php-fpm module.

pull/2088/head
sebres 2018-03-19 13:18:55 +01:00
parent 20fffc44c1
commit e8ffab28fb
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
config/filter.d/apache-noscript.conf
View File

@ -17,8 +17,13 @@ before = apache-common.conf
[Definition] [Definition]
failregex = ^%(_apache_error_client)s ((AH001(28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): /\S*(php([45]|[.-]cgi)?|\.asp|\.exe|\.pl)(, referer: \S+)?\s*$ script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl)
^%(_apache_error_client)s script '/\S*(php([45]|[.-]cgi)?|\.asp|\.exe|\.pl)\S*' not found or unable to stat(, referer: \S+)?\s*$
prefregex = ^%(_apache_error_client)s <F-CONTENT>.+</F-CONTENT>$
failregex = ^(?:(?:AH001(?:28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): <script>\b
^script '<script>\S*' not found or unable to stat
^(?:AH01071: )?Got error 'Primary script unknown\\n'
ignoreregex = ignoreregex =

2
fail2ban/tests/files/logs/apache-noscript
View File

@ -16,3 +16,5 @@
# apache 2.4 # apache 2.4
# failJSON: { "time": "2013-12-23T07:49:01", "match": true , "host": "204.232.202.107" } # failJSON: { "time": "2013-12-23T07:49:01", "match": true , "host": "204.232.202.107" }
[Mon Dec 23 07:49:01.981912 2013] [:error] [pid 3790] [client 204.232.202.107:46301] script '/var/www/timthumb.php' not found or unable to stat [Mon Dec 23 07:49:01.981912 2013] [:error] [pid 3790] [client 204.232.202.107:46301] script '/var/www/timthumb.php' not found or unable to stat
# failJSON: { "time": "2018-03-11T08:56:20", "match": true , "host": "192.0.2.106", "desc": "php-fpm error" }
[Sun Mar 11 08:56:20.913548 2018] [proxy_fcgi:error] [pid 742:tid 140142593419008] [client 192.0.2.106:50900] AH01071: Got error 'Primary script unknown\n'