72 lines
3.2 KiB
Plaintext
72 lines
3.2 KiB
Plaintext
# Fail2Ban apache-auth filter
|
|
#
|
|
|
|
[INCLUDES]
|
|
|
|
# Read common prefixes. If any customizations available -- read them from
|
|
# apache-common.local
|
|
before = apache-common.conf
|
|
|
|
[Definition]
|
|
|
|
# Mode for filter: normal (default) and aggressive (allows DDoS & brute force detection of mod_evasive)
|
|
mode = normal
|
|
|
|
# ignore messages of mod_evasive module:
|
|
apache-pref-ign-normal = (?!evasive)
|
|
# allow "denied by server configuration" from all modules:
|
|
apache-pref-ign-aggressive =
|
|
# mode related ignore prefix for common _apache_error_client substitution:
|
|
apache-pref-ignore = <apache-pref-ign-<mode>>
|
|
|
|
prefregex = ^%(_apache_error_client)s (?:AH\d+: )?<F-CONTENT>.+</F-CONTENT>$
|
|
|
|
# auth_type = ((?:Digest|Basic): )?
|
|
auth_type = ([A-Z]\w+: )?
|
|
|
|
failregex = ^client (?:denied by server configuration|used wrong authentication scheme)\b
|
|
^user (?!`)<F-USER>(?:\S*|.*?)</F-USER> (?:auth(?:oriz|entic)ation failure|not found|denied by provider)\b
|
|
^Authorization of user <F-USER>(?:\S*|.*?)</F-USER> to access .*? failed\b
|
|
^%(auth_type)suser <F-USER>(?:\S*|.*?)</F-USER>: password mismatch\b
|
|
^%(auth_type)suser `<F-USER>(?:[^']*|.*?)</F-USER>' in realm `.+' (auth(?:oriz|entic)ation failure|not found|denied by provider)\b
|
|
^%(auth_type)sinvalid nonce .* received - length is not\b
|
|
^%(auth_type)srealm mismatch - got `(?:[^']*|.*?)' but expected\b
|
|
^%(auth_type)sunknown algorithm `(?:[^']*|.*?)' received\b
|
|
^invalid qop `(?:[^']*|.*?)' received\b
|
|
^%(auth_type)sinvalid nonce .*? received - user attempted time travel\b
|
|
^(?:No h|H)ostname \S+ provided via SNI(?:, but no hostname provided| and hostname \S+ provided| for a name based virtual host)\b
|
|
|
|
ignoreregex =
|
|
|
|
# DEV Notes:
|
|
#
|
|
# This filter matches the authorization failures of Apache. It takes the log messages
|
|
# from the modules in aaa that return HTTP_UNAUTHORIZED, HTTP_METHOD_NOT_ALLOWED or
|
|
# HTTP_FORBIDDEN and not AUTH_GENERAL_ERROR or HTTP_INTERNAL_SERVER_ERROR.
|
|
#
|
|
# An unauthorized response 401 is the first step for a browser to instigate authentication
|
|
# however apache doesn't log this as an error. Only subsequent errors are logged in the
|
|
# error log.
|
|
#
|
|
# Source:
|
|
#
|
|
# By searching the code in http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/aaa/*
|
|
# for ap_log_rerror(APLOG_MARK, APLOG_ERR and examining resulting return code should get
|
|
# all of these expressions. Lots of submodules like mod_authz_* return back to mod_authz_core
|
|
# to return the actual failure.
|
|
#
|
|
# Note that URI can contain spaces.
|
|
#
|
|
# See also: http://wiki.apache.org/httpd/ListOfErrors
|
|
# Expressions that don't have tests and aren't common.
|
|
# more be added with https://issues.apache.org/bugzilla/show_bug.cgi?id=55284
|
|
# ^user .*: nonce expired \([\d.]+ seconds old - max lifetime [\d.]+\) - sending new nonce\s*$
|
|
# ^user .*: one-time-nonce mismatch - sending new nonce\s*$
|
|
# ^realm mismatch - got `(?:[^']*|.*?)' but no realm specified\s*$
|
|
#
|
|
# Because url/referer are foreign input, short form of regex used if long enough to idetify failure.
|
|
#
|
|
# Author: Cyril Jaquier
|
|
# Major edits by Daniel Black and Ben Rubson.
|
|
# Rewritten for v.0.10 by Sergey Brester (sebres).
|