正则表达式fail2ban规则

Question

我在服务器上设置了Fail2ban，最近有很多恶意机器人在抓取我的网站，导致我的SQL服务器停机

从我的Apache2日志

51.255.65.13 - - [10/Dec/2017:12:03:19 +0800] "GET /crew/nm0935095-gary-winick HTTP/1.0" 200 17985 "-" "Mozilla/5.0 (compatible; AhrefsBot/5.2; +http://ahrefs.com/robot/)"
51.255.65.30 - - [10/Dec/2017:12:03:31 +0800] "GET /movie/tt0498567-summer-time-machine-blues HTTP/1.0" 200 17658 "-" "Mozilla/5.0 (compatible; AhrefsBot/5.2; +http://ahrefs.com/robot/)"
217.182.132.190 - - [10/Dec/2017:12:03:36 +0800] "GET /movie/tt1705064-genji-monogatari:-sennen-no-nazo/ HTTP/1.0" 200 17344 "-" "Mozilla/5.0 (compatible; AhrefsBot/5.2; +http://ahrefs.com/robot/)"

如何为“ ahrefs.com”创建failregex？

非常感谢

Answer 1

为了捕获包含“ ahrefs.com”的任何内容，您的failregex如下所示：

failregex = ^<HOST>.*ahrefs\.com.*

其中<HOST>标记是内置的Fail2ban作为(?:::f{4,6}:)?(?P<host>\\S+)的别名：

https://www.fail2ban.org/wiki/index.php/Apache