Salut,
[quote=“ripat”]…Une règle fail2ban mal écrite ou mal exécutée?
[/quote]
Tu as peut être vu juste, mais je dois avoir une foutu poutre dans l’œil … 
J’ai commenté toutes ces règles (gras), une à une, et chaque fois j’ai lancé une vérification.
[quote]:~# fail2ban-regex /var/log/apache2/access.log /etc/fail2ban/filter.d/apache-w00tw00t.conf
Running tests
Use regex file : /etc/fail2ban/filter.d/apache-w00tw00t.conf
Use log file : /var/log/apache2/access.log
Results
Failregex
|- Regular expressions:
| [1] [[]client []] (client sent HTTP/1.1 request without hostname|Invalid method in request|request failed: URI too long|erroneous characters after protocol string)
| [2] ^ -."GET /w00tw00t.at.ISC.SANS.DFind:).".*
| [3] ^ -."GET /w00tw00t.".*
| [4] .[client .w00tw00t.
| [5] ^ -.“GET /w00tw00t.at.ISC.SANS.test0:).".
| [6] ^ -."GET /w00tw00t.at.ISC.SANS.test:).”.*
| [7] ^ -."GET /w00tw00t.at.ISC.SANS.test1:).".*
| [8] ^ -."GET /w00tw00t.at.blackhats.romanian.anti-sec:).".*
| [9] ^ -."GET [\w{1,3} \w{1,3} \d{1,2} \d{1,2}:\d{1,2}:\d{1,2} \d{1,4}] [error] [client 91.x.x.x] File does not exist: /.{1,20}/(w00tw00t|wootwoot|WootWoot|WooTWooT).{1,250}.".*
|
`- Number of matches:
[1] 0 match(es)
[2] 0 match(es)
[3] 0 match(es)
[4] 0 match(es)
[5] 0 match(es)
[6] 0 match(es)
[7] 0 match(es)
[8] 0 match(es)
[9] 0 match(es)
Ignoreregex
|- Regular expressions:
|
`- Number of matches:
Summary
Sorry, no match
Look at the above section ‘Running tests’ which could contain important
information.
:~#
[/quote]
Ou est elle, cette poutre ?
Il semblerait que ce soit celle là, qui engendre : Unable to find a corresponding IP address
[code]:~# fail2ban-regex /var/log/apache2/access.log-20120610 /etc/fail2ban/filter.d/apache-w00tw00t.conf
Running tests
Use regex file : /etc/fail2ban/filter.d/apache-w00tw00t.conf
Use log file : /var/log/apache2/access.log-20120610
Unable to find a corresponding IP address for hosted-by.paylasweb.net
Unable to find a corresponding IP address for hosted-by.paylasweb.net
Unable to find a corresponding IP address for tj-201-140-164-2.gtel.net.mx
Unable to find a corresponding IP address for tj-201-140-164-2.gtel.net.mx
Unable to find a corresponding IP address for hosted-by.paylasweb.net
Unable to find a corresponding IP address for hosted-by.paylasweb.net
Unable to find a corresponding IP address for 207.46.13.99-msnbot-207-46-13-99.search.msn.com
Unable to find a corresponding IP address for 207.46.13.99-msnbot-207-46-13-99.search.msn.com
Unable to find a corresponding IP address for 72.167.247.195.ip-msnbot-65-52-108-26.search.msn.com
Unable to find a corresponding IP address for 72.167.247.195.ip-msnbot-65-52-108-26.search.msn.com
Results
Failregex
|- Regular expressions:
| [1] [[]client []] (client sent HTTP/1.1 request without hostname|Invalid method in request|request failed: URI too long|erroneous characters after protocol string)
| [2] ^ -."GET /w00tw00t.at.ISC.SANS.DFind:).".*
| [3] ^ -."GET /w00tw00t.".*
| [4] .[client .w00tw00t.
| [5] ^ -.“GET /w00tw00t.at.ISC.SANS.test0:).".
| [6] ^ -."GET /w00tw00t.at.ISC.SANS.test:).”.*
| [7] ^ -."GET /w00tw00t.at.ISC.SANS.test1:).".*
| [8] ^ -."GET /w00tw00t.at.blackhats.romanian.anti-sec:).".*
| [9] ^ -."GET [\w{1,3} \w{1,3} \d{1,2} \d{1,2}:\d{1,2}:\d{1,2} \d{1,4}] [error] [client 91.x.x.x] File does not exist: /.{1,20}/(w00tw00t|wootwoot|WootWoot|WooTWooT).{1,250}.".*
|
`- Number of matches:
[1] 0 match(es)
[2] 10 match(es)
[3] 13 match(es)
[4] 0 match(es)
[5] 2 match(es)
[6] 0 match(es)
[7] 0 match(es)
[8] 0 match(es)
[9] 0 match(es)
Ignoreregex
|- Regular expressions:
|
`- Number of matches:
Summary
Addresses found:
[1]
[2]
89.121.253.227 (Tue Jun 05 16:45:25 2012)
89.121.253.227 (Tue Jun 05 16:54:24 2012)
69.24.67.227 (Wed Jun 06 06:54:45 2012)
213.79.125.20 (Thu Jun 07 21:08:29 2012)
213.79.125.20 (Thu Jun 07 23:21:29 2012)
50.63.137.16 (Fri Jun 08 04:32:10 2012)
12.52.57.157 (Fri Jun 08 04:47:08 2012)
74.86.27.131 (Sat Jun 09 10:48:26 2012)
31.210.99.87 (Sat Jun 09 14:40:29 2012)
31.210.99.87 (Sat Jun 09 14:44:26 2012)
[3]
62.225.128.44 (Tue Jun 05 15:09:17 2012)
89.121.253.227 (Tue Jun 05 16:45:25 2012) (already matched)
89.121.253.227 (Tue Jun 05 16:54:24 2012) (already matched)
176.31.8.59 (Tue Jun 05 19:39:53 2012)
69.24.67.227 (Wed Jun 06 06:54:45 2012) (already matched)
213.79.125.20 (Thu Jun 07 21:08:29 2012) (already matched)
213.79.125.20 (Thu Jun 07 23:21:29 2012) (already matched)
50.63.137.16 (Fri Jun 08 04:32:10 2012) (already matched)
12.52.57.157 (Fri Jun 08 04:47:08 2012) (already matched)
74.86.27.131 (Sat Jun 09 10:48:26 2012) (already matched)
31.210.99.87 (Sat Jun 09 14:40:29 2012) (already matched)
31.210.99.87 (Sat Jun 09 14:44:26 2012) (already matched)
176.31.53.130 (Sat Jun 09 17:44:06 2012)
[4]
[5]
176.31.8.59 (Tue Jun 05 19:39:53 2012) (already matched)
176.31.53.130 (Sat Jun 09 17:44:06 2012) (already matched)
[6]
[7]
[8]
[9]
Date template hits:
0 hit(s): MONTH Day Hour:Minute:Second
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second Year
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second
0 hit(s): Year/Month/Day Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
881 hit(s): Day/MONTH/Year:Hour:Minute:Second
0 hit(s): Month/Day/Year:Hour:Minute:Second
0 hit(s): Year-Month-Day Hour:Minute:Second
0 hit(s): Year.Month.Day Hour:Minute:Second
0 hit(s): Day-MONTH-Year Hour:Minute:Second[.Millisecond]
0 hit(s): Day-Month-Year Hour:Minute:Second
0 hit(s): TAI64N
0 hit(s): Epoch
0 hit(s): ISO 8601
0 hit(s): Hour:Minute:Second
0 hit(s): <Month/Day/Year@Hour:Minute:Second>
Success, the total number of match is 25
However, look at the above section ‘Running tests’ which could contain important
information.
root@schema-indus:~#[/code]
Rhôooo, ma foi c’est open-source … 
[code]:~# cat /etc/fail2ban/filter.d/apache-auth.conf
Fail2Ban configuration file
Author: Cyril Jaquier
$Revision$
[Definition]
Option: failregex
Notes.: regex to match the password failure messages in the logfile. The
host must be matched by a group named “host”. The tag “” can
be used for standard IP/hostname matching and is only an alias for
(?:::f{4,6}:)?(?P[\w-.^_]+)
Values: TEXT
failregex = [[]client []] user .* authentication failure
[[]client []] user .* not found
[[]client []] user .* password mismatch
Option: ignoreregex
Notes.: regex to ignore. If this regex matches, the line is ignored.
Values: TEXT
ignoreregex =
:~#
[/code]
