Answer the question
In order to leave comments, you need to log in
How to create regex or why doesn't the filter work?
Good day to all.
The bottom line is, nginx 1.9.12 is installed, access to /ip/adm is blocked by the standard http_access module. Only me is allowed access.
in nginx-errors.log, respectively, when someone else climbs, it remains
2016/04/04 10:15:24 [error] 10934#0: *41120 access forbidden by rule, client: 213.87.х.х, server: localhost, request: "GET /administrator/ HTTP/1.1", host: "c.ru"
[ssh]
enabled = true
filter = sshd
action = pf
logpath = /var/log/auth.log
findtime = 600
maxretry = 3
bantime = 3600
<b>[adminka]
enable = true
filter = adminka
action = pf
logpath = /var/log/nginx-error.log
findtime = 333600
maxretry = 1
bantime = 3600</b>
[Definition]
_daemon = adminka
failregex = ^.* access forbidden by rule, client: <HOST>, server.*
ignoreregex =
fail2ban-regex /var/log/nginx-error.log /usr/local/etc/fail2ban/filter.d/adminka.conf
Running tests
=============
Use failregex filter file : adminka, basedir: /usr/local/etc/fail2ban
Use log file : /var/log/nginx-error.log
Use encoding : US-ASCII
Results
=======
Failregex: 36 total
|- #) [# of hits] regular expression
| 1) [36] ^.* access forbidden by rule, client: <HOST>, server.*
`-
Ignoreregex: 0 total
Date template hits:
|- [# of hits] date format
| [2220] Year(?P<_sep>[-/.])Month(?P=_sep)Day 24hour:Minute:Second(?:,Microseconds)?
`-
Lines: 2221 lines, 0 ignored, 36 matched, 2185 missed
[processed in 0.50 sec]
Missed line(s): too many to print. Use --print-all-missed to print all 2185 lines
Answer the question
In order to leave comments, you need to log in
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question