fail2ban/config/filter.d/apache-pass.conf

# Fail2Ban Apache pass filter
# This filter is for access.log, NOT for error.log
#
# The knocking request must have a referer.

[INCLUDES]

before = apache-common.conf

[Definition]

failregex = ^<HOST> - \w+ \[\] "GET <knocking_url> HTTP/1\.[01]" 200 \d+ ".*" "[^-].*"$

ignoreregex =

[Init]

knocking_url = /knocking/

# Author: Viktor Szépe