fail2ban regex to block User Agent

Question

I can’t manage to set up the regex for Fail2Ban to block something like this:

"54.88.84.219 - - [21/Dec/2024:13:41:37 +0000] "GET /events/category/stand-up/day/4586-04-01/ HTTP/1.1" 200 46581 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36""

I tried:

[Definition] failregex = ^ - - [.?] "(GET|POST|HEAD).(HTTP/.)" ."Mozilla/5.0.Amazonbot." ignoreregex =

But for some reason it does not work!

Andrzej Majewski Phones Rescue · Accepted Answer · 2024-12-21 18:54:39Z

1

I found the cause. My server is OpenLiteSpeed with CyberPanel. While the main web server logs in the access.log file are recorded in the format: %h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i, the logs for individual sites in the /home directory are written in the format: "%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i" (with additional quotation marks at the beginning and end). I have no idea why this is the case – whether it's a feature of OpenLiteSpeed or CyberPanel. The problem is solved. Thanks!

answered Dec 21, 2024 at 18:54

Andrzej Majewski Phones Rescue

392 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

fail2ban regex to block User Agent

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related