# Fail2Ban apache-auth filter
#

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# apache-common.local
before = apache-common.conf

[Definition]

prefregex = ^%(_apache_error_client)s (?:AH\d+: )?<F-CONTENT>.+</F-CONTENT>$

# auth_type = ((?:Digest|Basic): )?
auth_type = ([A-Z]\w+: )?

failregex = ^client denied by server configuration: (uri )?\S*(, referer: \S+)?\s*$
            ^user .*? authentication failure for "\S*": Password Mismatch(, referer: \S+)?$
            ^user .*? not found(: )?\S*(, referer: \S+)?\s*$
            ^client used wrong authentication scheme: \S*(, referer: \S+)?\s*$
            ^Authorization of user \S+ to access \S* failed, reason: .*$
            ^%(auth_type)suser .*?: password mismatch: \S*(, referer: \S+)?\s*$
            ^%(auth_type)suser `.*?' in realm `.+' (not found|denied by provider): \S*(, referer: \S+)?\s*$
            ^user .*?: authorization failure for "\S*":(, referer: \S+)?\s*$
            ^%(auth_type)sinvalid nonce .* received - length is not \S+(, referer: \S+)?\s*$
            ^%(auth_type)srealm mismatch - got `.*?' but expected `.+'(, referer: \S+)?\s*$
            ^%(auth_type)sunknown algorithm `.*?' received: \S*(, referer: \S+)?\s*$
            ^invalid qop `.*?' received: \S*(, referer: \S+)?\s*$
            ^%(auth_type)sinvalid nonce .*? received - user attempted time travel(, referer: \S+)?\s*$

ignoreregex = 

# DEV Notes:
#
# This filter matches the authorization failures of Apache. It takes the log messages
# from the modules in aaa that return HTTP_UNAUTHORIZED, HTTP_METHOD_NOT_ALLOWED or
# HTTP_FORBIDDEN and not AUTH_GENERAL_ERROR or HTTP_INTERNAL_SERVER_ERROR.
#
# An unauthorized response 401 is the first step for a browser to instigate authentication
# however apache doesn't log this as an error. Only subsequent errors are logged in the 
# error log.
#
# Source:
#
# By searching the code in http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/*
# for ap_log_rerror(APLOG_MARK, APLOG_ERR and examining resulting return code should get
# all of these expressions. Lots of submodules like mod_authz_* return back to mod_authz_core
# to return the actual failure.
#
# See also: http://wiki.apache.org/httpd/ListOfErrors
# Expressions that don't have tests and aren't common.
# more be added with  https://issues.apache.org/bugzilla/show_bug.cgi?id=55284 
#     ^%(_apache_error_client)s (AH01778: )?user .*: nonce expired \([\d.]+ seconds old - max lifetime [\d.]+\) - sending new nonce\s*$
#     ^%(_apache_error_client)s (AH01779: )?user .*: one-time-nonce mismatch - sending new nonce\s*$
#     ^%(_apache_error_client)s (AH02486: )?realm mismatch - got `.*' but no realm specified\s*$
#
# referer is always in error log messages if it exists added as per the log_error_core function in server/log.c
# 
# Author: Cyril Jaquier
# Major edits by Daniel Black and Sergey Brester (sebres)