環境

Ubunta 16.04
fail2ban 0.10.4
nginx 1.10.3
沒裝 php , mysql

情境描述

最近因為一直被

45.6.76.58 - - [05/Aug/2019:22:41:45 +0000] "GET /logon.php HTTP/1.1" 301 194 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0"
45.6.76.58 - - [05/Aug/2019:22:41:45 +0000] "GET /help-e.php HTTP/1.1" 301 194 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0"
45.6.76.58 - - [05/Aug/2019:22:41:45 +0000] "GET /license.php HTTP/1.1" 301 194 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0"
45.6.76.58 - - [05/Aug/2019:22:41:45 +0000] "GET /log.php HTTP/1.1" 301 194 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0"
45.6.76.58 - - [05/Aug/2019:22:41:45 +0000] "GET /hell.php HTTP/1.1" 301 194 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0"
45.6.76.58 - - [05/Aug/2019:22:41:46 +0000] "GET /pmd_online.php HTTP/1.1" 301 194 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0"

所以裝了 fail2ban 想說來擋掉這些 ip
於是作了以下設定

jail.local設定

[DEFAULT]
#3600秒內失敗2次就ban,bantime=-1 == 永久

bantime = -1
findtime = 3600
maxretry = 2

ignoreip = 127.0.0.1

[sshd]
enabled = true
mode   = normal
port    = ssh
logpath = /var/log/auth.log
#backend = systemd

[nginx-http-auth]
enabled = true
port    = http,https
logpath = /var/log/nginx/error.log

[nginx-botsearch]
enabled = true
port     = http,https
logpath  = /var/log/nginx/error.log

[http-cc]
enabled = true
port = http,https
filter = nginx-cc
logpath = /var/log/nginx/access.log
action = iptables-multiport[name=nginxcc, port="http,https", protocol=tcp]
maxretry = 480
findtime = 60
bantime = 86400

[phpmyadmin-syslog]
enabled = true
port = http,https
logpath = /var/log/nginx/access.log

但發現即使 [phpmyadmin-syslog] 有開，來自 45.6.76.58 的"善液" 還是源源不絕

於是猜測可能因為我本身沒有裝php，所以把 [phpmyadmin-syslog] 的 logpath 設在/var/log/nginx/access.log 可能造成 regex 不合身(php 和 nginx log檔格式不同造成)，因此失敗。

所以我自己重寫一個規則去 regex 。

1. copy nginx access.log 並把紀錄貼在 https://regex101.com/
2. 寫好正則表達式
3. 把寫好的正則改成 fail2ban 的版本(改)
4. fail2ban-regex access.log /etc/fail2ban/filter.d/nginx-php-out.conf

(先寫正則)

(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})[^\"]+\"(GET|POST)\s\/([^\"]+\.PHP|mysql|[^\"]+\.php|manager\/html){1,}.+\"

(改fail2ban版本)

<HOST>[^\"]+\"(GET|POST)\s\/([^\"]+\.PHP|mysql|[^\"]+\.php|manager\/html){1,}.+\"

(發現自己寫的無法使用...)

這個寫法是參考
https://newtoypia.blogspot.com/2016/04/fail2ban.html

完整版code:
https://gist.github.com/ckhung/a5710351b281c4bd079c7b38a692b9d6

問題

1.請問要怎麼修改正則讓他能正常運作?

2.請問有沒有官方或網友有其他更漂亮的解決方式?
(可能有但我沒挖到，故此一問...)