gitea
dd7f8dd1a2
Dockerized Fail2Ban + dashboard for Nginx Proxy Manager. - Single-container image (fail2ban + Node.js + supervisord) - Pre-built NPM filters: badbot, http-errors, npm-probe, manual-bans - Web dashboard with live ban feed, log scanner, AbuseIPDB integration - Configurable via environment variables and .env file - Persistent volumes for config and ban history - Webhook support for ban event notifications - README, .gitignore, MIT license Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
29 lines
2.2 KiB
Plaintext
29 lines
2.2 KiB
Plaintext
# ── F2B Control Center — badbot filter ───────────────────────────────────────
|
|
#
|
|
# Blocks known malicious scanners, vulnerability testers, and exploit frameworks
|
|
# by their HTTP User-Agent string.
|
|
#
|
|
# LOG FORMAT:
|
|
# Primary pattern matches NPM logs with [Client IP] real-IP field:
|
|
# PROXY_IP - - [date] "GET /" 200 146 "-" "UserAgent" [Client REAL_IP]
|
|
#
|
|
# If your NPM logs have the client IP at line start (standard nginx combined),
|
|
# uncomment the alternative failregex lines instead.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
[Definition]
|
|
|
|
# ── Primary: NPM [Client IP] format ──────────────────────────────────────────
|
|
failregex = ^[^ ]+ - -[^\[]*\[[^\]]+\] "[A-Z]+ [^"]*" \d{3} \d+ "[^"]*" "(?:masscan|zgrab|python-requests|Go-http-client/1\.1|[Nn]uclei|sqlmap|dirbuster|gobuster|nikto|nmap|wfuzz|Metasploit|libwww-perl|WPScan|ZmEu|jorgee|NetcraftSurveyAgent|Expanse|Shodan|censys|BinaryEdge|internet-measurement|SemrushBot|AhrefsBot)[^"]*" \[Client <HOST>\]
|
|
|
|
# ── Alternative: standard nginx combined format (IP at line start) ────────────
|
|
# Uncomment and comment out the Primary line above to use this instead.
|
|
# failregex = ^<HOST> - -[^\[]*\[[^\]]+\] "[A-Z]+ [^"]*" \d{3} \d+ "[^"]*" "(?:masscan|zgrab|python-requests|Go-http-client/1\.1|[Nn]uclei|sqlmap|dirbuster|gobuster|nikto|nmap|wfuzz|Metasploit|libwww-perl|WPScan|ZmEu|jorgee|NetcraftSurveyAgent|Expanse|Shodan|censys|BinaryEdge|internet-measurement)[^"]*"
|
|
|
|
ignoreregex =
|
|
|
|
# ── Notes ────────────────────────────────────────────────────────────────────
|
|
# Add more UA patterns to the failregex alternation as needed.
|
|
# Test your filter with:
|
|
# fail2ban-regex /nginx-logs/proxy-host-1_access.log /etc/fail2ban/filter.d/badbot.conf
|