Need fail2ban regex for apache with ISPConfig

[AlArenal]

I have the following situation:
On some days Trackback-Spambots target one of my websites and with their post-requests create gigabytes of incoming (!) traffic on a single day (I measured up to 9.3 GB by now). I habe fail2ban installed and want it to ban the corresponding ips, but unfortunately I don't know much about regular expressions and because I use ISPConfig on my server, my apache's log files don't have the standard format.

This is ISPConfig's apache2 log format:
LogFormat "%v||||%b||||%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined_ispconfig

This is an example entry in the log. To-be-blocked entries can be recognized by the UserAgent "TrackBack/1.02":
www.mydomain.tld||||459||||123.123.123.123 - - [05/Mar/2007:14:39:21 +0100] "POST /123.html/trackback/ HTTP/1.0" 301 459 "http://www.mydomain.tld/123.html/trackback" "TrackBack/1.02"

The fail2ban apache documentation is very short:
http://www.fail2ban.org/wiki/index.php/Apache

Once a solution has been found, I'm going to update some blog and wiki entries to provide it to the community.

Regards,
al

[falko]

Originally Posted by AlArenal

The fail2ban apache documentation is very short:
http://www.fail2ban.org/wiki/index.php/Apache

The documentation is referring to Apache's error log, not the access log. The error log format isn't changed by ISPConfig, so you shouldn't have any problems using fail2ban.

[AlArenal]

That's because fail2ban as default config tries to ban ips from which failed login requests came whereas I want to ban spambots which do not produce errors. Or do you mean I should rewrite my .htaccess to raise an error for that particular user agent? Haven't looked at the documentation whether that is possible...

Another idea is to install mod_security and let fail2ban observe this log instead. I found some references on the web and will post an update once I got it up and running.

Stay tuned...

[ts-onlyfree]

i got it working with "/var/log/httpd/ispconfig_access_log"

failregex =  www\.ts-onlyfree\.org\|\|\|\|\d*\|\|\|\|<HOST> -.*"GET \/w00tw00t\.at\.ISC\.SANS\.DFind\:\).*".*