Fail2Ban 过滤器错误

Question

我正在尝试添加两个 fail2ban 过滤器，一个用于 post flood 和 phpmyadmin brute force，但出现以下错误。

日志：

fail2ban.filter : ERROR  No 'host' group in '[[]client []] File does not exist: /var/www/(?:PMA|phpmyadmin|myadmin|mysql|mysqladmin|sqladmin|mypma|admin|xampp|mysqldb|mydb|db|pmadb|phpmyadmin1|phpmyadmin2)'

fail2ban.filter : ERROR  No 'host' group in '^ -.*”POST.*'

监狱.conf：

[apache-phpmyadmin]
enabled  = true
port     = http,https
filter   = apache-phpmyadmin
logpath  = /var/log/apache*/*error.log
maxretry = 3

[apache-postflood]
enabled = true
port = http,https
filter = apache-postflood
logpath = /var/log/apache*/*flood.log
findtime = 10
maxretry = 10

apache-phpmyadmin.conf 过滤器：

[Definition] 
docroot = /var/www
badadmin = PMA|phpmyadmin|myadmin|mysql|mysqladmin|sqladmin|mypma|admin|xampp|mysqldb|mydb|db|pmadb|phpmyadmin1|phpmyadmin2
failregex = [[]client []] File does not exist: %(docroot)s/(?:%(badadmin)s)
ignoreregex =

apache-postflood.conf 过滤器：

[Definition]
failregex = ^ -.*”POST.*
ignoreregex =

Answer 1

您failregex缺少<HOST>必须在 IP 地址出现在日志条目中的位置插入的特殊字符串。这是必需的，以便fail2ban 知道它应该作用于哪个IP 地址。