Skip to content

Instantly share code, notes, and snippets.

View Abrynos's full-sized avatar

Sebastian Göls Abrynos

View GitHub Profile
@Abrynos
Abrynos / postfixadmin.conf
Created May 30, 2022 21:37
fail2ban filter to catch authentication failures with postfixadmin via nginx logs
[Definition]
failregex = ^.*PostfixAdmin (admin|user) login failed .*ip_address: <HOST>.*$
(?i)^<HOST> -.*] \"(GET|POST|PUT|DELETE|HEAD) (/.*)?/\.git/
@Abrynos
Abrynos / nginx-403.conf
Created May 30, 2022 21:36
nginx filter for too many forbidden responses - use with care
[Definition]
failregex = ^<HOST> -.*"(GET|POST|PUT|DELETE|HEAD).*HTTP.*" 403
ignoreregex =
@Abrynos
Abrynos / nginx-401.conf
Created May 30, 2022 21:32
fail2ban config for banning on too many authentication failures
[Definition]
failregex = ^<HOST> -.*"(GET|POST|PUT|DELETE|HEAD).*HTTP.*" 401
ignoreregex =
@Abrynos
Abrynos / nginx-extras.conf
Last active November 27, 2022 21:09
A fail2ban filter for script kiddies trying to fuck with nginx
[Definition]
failregex = (?i)^<HOST> -.*] \"SSH-2(\.0)?-Go
(?i)^<HOST> -.*] \"PRI
(?i)^<HOST> -.*] \"SSTP_DUPLEX_POST
(?i)^<HOST> -.*] \"CONNECT
(?i)^<HOST> -.*] \"[A-Z]+ (/.*)?/cgi-bin/
(?i)^<HOST> -.*] \"[A-Z]+ (/.*)?/\.git/
(?i)^<HOST> -.*] \"[A-Z]+ (/.*)?/\.env
(?i)^<HOST> -.*] \"[A-Z]+ /\.?aws