Blog rafroma

fail2ban apache scan

Create filter in/etc/fail2ban/filter.d/apache-sensitive.conf

[Definition]
failregex = ^ .* "(GET|POST|HEAD).*\/.*(\.env|\.git|xmlrpc\.php|wp-login\.php|phpinfo\.php|credentials|aws|Dockerfile|composer\.json|composer\.lock).*" (403|404)
ignoreregex =

Add to /etc/fail2ban/jail.local

[apache-sensitive]
enabled = true
filter = apache-sensitive
port = http,https
logpath = /var/log/apache2/*_access.log
findtime = 300
maxretry = 3
bantime = 604800
backend = auto