1

Fail2ban filter for SVR.JS with easy-waf integration

Firewall and Security | by dorianniemiec | submitted in September 28, 2024

The filter for analyzing SVR.JS worker log files with easy-waf integration mod installed. From the SVR.JS forum post titled "Integrating SVR.JS with easy-waf integration installed with Fail2ban"

[Init]
maxlines = 10

[Definition]

failregex = ^\S+ SERVER REQUEST MESSAGE \[Request Id: ([0-9a-f]{6})\]: Client (?:::ffff:)?<HOST>(?::[0-9]{0,5})? .+\n(?:\S+ SERVER REQUEST MESSAGE \[Request Id: \1\]: Client uses .+\n)?\S+ SERVER RESPONSE ERROR MESSAGE \[Request Id: \1\]: Request blocked by EasyWAF. Module: .+
ignoreregex =

# See https://forum.svrjs.org/how-tos-and-tips/integrating-svr-js-with-easy-waf-integration-with-fail2ban-t23.html for more information on how to use this filter