problem: overload of failed apache2 access like: [01/Dec/2021:14:25:23 +0100] "POST /dk/produkt/foo/ HTTP/1.1" 404 58708 "h.. solution: create a fail2ban entry to block the requestion IP 1. Create a 404 filter rule to /etc/fail2ban/filter.d/apache-404.conf [Definition] failregex = ^<HOST> - .* "(GET|POST|HEAD).*HTTP.*" 404 .*$ #failregex = (?P<host>[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}) .+ 404 [0-9]+ #failregex = ^<HOST> - - \[[^\]]*\] "[^\"]+" 404\s ignoreregex =.*(robots.txt|favicon.ico|jpg|png) 2. add to /etc/fail2ban/jail.conf [apache-404] enabled = true port = http,https filter = apache-404 logpath = /var/customers/logs/foo.log bantime = 3600 findtime = 3600 maxretry = 4 3. restart fail2ban: /etc/init.d/fail2ban restart 4. test fail2ban: /etc/init.d/fail2ban restart 5. see the logs of fail2ban: tail /var/log/fail2ban.log -f

https://bobcares.com/blog/fail2ban-apache-404/

Example [Definition] failregex = \[remote <HOST>\:.*\] BANTH1SIP ignoreregex =.*(robots.txt|favicon.ico|jpg|png) for log line: [Thu Jun 02 14:32:21.927775 2022] [wsgi:error] [pid 5177] [remote 183.88.219.47:1580] BANTH1SIP full request:{'SCRIPT_URL': '/lustig.php', 'SCRIPT_URI': 'https://www.body-piercing.com/lustig.php', 'SSL_TLS_SNI': 'www.body-piercing.com', 'GATEWAY_INTERFACE': 'CGI/1.1', 'SERVER_PROTOCOL': 'HTTP/1.1', 'REQUEST_METHOD': 'GET', 'QUERY_STRING': '', 'REQUEST_URI': '/lustig.php', 'SCRIPT_NAME': '', 'PATH_INFO': '/lustig.php', 'PATH_TRANSLATED': '/var/customers/webs/shop4/pgt to test a reg you can use : https://www.regextester.com/94338 01.12.21

https://www.regextester.com/94338

• Home
• Notebook
• Contact us

• Privacy Statement
• 

Copyleft ☠ 2024