# HG changeset patch
# User Pascal Bellard <pascal.bellard@slitaz.org>
# Date 1345198902 -7200
# Node ID 585734d0d3e16961e13ee0f9b94d517717454292
# Parent  82b8882289240722c46a71bb293a6e5857e41e23
fail2ban: add filter.d/lighttpd-fastcgi.conf

diff -r 82b888228924 -r 585734d0d3e1 fail2ban/receipt
--- a/fail2ban/receipt	Fri Aug 17 09:13:42 2012 +0200
+++ b/fail2ban/receipt	Fri Aug 17 12:21:42 2012 +0200
@@ -30,6 +30,14 @@
 	sed -i -e 's|127.0.0.1|& 192.168.0.0/16|;s|sshd.log|messages|' \
 		-e '/ssh-iptables/{nn;s/false/true/}' $fs/etc/fail2ban/jail.conf
 	cat >> $fs/etc/fail2ban/jail.conf <<EOT
+[lighttpd-fastcgi]
+
+enabled  = false
+port     = http,https
+filter   = lighttpd-fastcgi
+logpath  = /var/log/lighttpd/*error*.log
+maxretry = 2
+
 [ssh-ddos]
 
 enabled  = true
diff -r 82b888228924 -r 585734d0d3e1 fail2ban/stuff/etc/fail2ban/filter.d/lighttpd-fastcgi.conf
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/fail2ban/stuff/etc/fail2ban/filter.d/lighttpd-fastcgi.conf	Fri Aug 17 12:21:42 2012 +0200
@@ -0,0 +1,18 @@
+# Fail2Ban configuration file
+#
+# Author: Arturo 'Buanzo' Busleiman <buanzo@buanzo.com.ar>
+#
+
+[Definition]
+
+# Option:  failregex
+# Notes.:  regex to match ALERTS as notified by lighttpd's FastCGI Module
+# Values:  TEXT
+#
+failregex = .*ALERT\ -\ .*attacker\ \'<HOST>\'
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+ignoreregex =