In my /filter.d/ directory of Fail2ban there are many filters.

    3proxy.conf                asterisk.conf          ejabberd-auth.conf      lighttpd-auth.conf    oracleims.conf          selinux-common.conf   tine20.conf
    apache-auth.conf           badbot.conf            exim-common.conf        mongodb-auth.conf     pam-generic.conf        selinux-ssh.conf      uwimap-auth.conf
    apache-badbots.conf        botsearch-common.conf  exim.conf               monit.conf            perdition.conf          sendmail-auth.conf    vsftpd.conf
    apache-botsearch.conf      common.conf            exim-spam.conf          murmur.conf           phpmyadmin-syslog.conf  sendmail-reject.conf  webmin-auth.conf
    apache-common.conf         counter-strike.conf    freeswitch.conf         mysqld-auth.conf      php-url-fopen.conf      sieve.conf            wp-admin.conf
    apache-fakegooglebot.conf  courier-auth.conf      froxlor-auth.conf       nagios.conf           portsentry.conf         slapd.conf            wp-login.conf
    apache-modsecurity.conf    courier-smtp.conf      groupoffice.conf        named-refused.conf    postfix.conf            sogo-auth.conf        wuftpd.conf
    apache-nohome.conf         cyrus-imap.conf        gssftpd.conf            nginx-botsearch.conf  proftpd.conf            solid-pop3d.conf      xinetd-fail.conf
    apache-noscript.conf       directadmin.conf       guacamole.conf          nginx-http-auth.conf  pure-ftpd.conf          squid.conf            zoneminder.conf
    apache-overflows.conf      domino-smtp.conf       haproxy-http-auth.conf  nginx-limit-req.conf  qmail.conf              squirrelmail.conf
    apache-pass.conf           dovecot.conf           horde.conf              nsd.conf              recidive.conf           sshd.conf
    apache-shellshock.conf     dropbear.conf          ignorecommands          openhab.conf          roundcube-auth.conf     stunnel.conf
    assp.conf                  drupal-auth.conf       kerio.conf              openwebmail.conf      screensharingd.conf     suhosin.conf

Some I can understand more or less what they do from the name, others I have no idea.

Is there an online page with 2 lines of description for each filter?

I searched online and on the site of Fail2ban, but even with the name of the filter finds little.

  • 1
    Most of the filters are commented - some extensively, others less so. Feb 3, 2019 at 4:47
  • I started to open them one by one, something I also understood, but how do I understand what I have to write in jail.local to activate a filter?
    – alebal
    Feb 6, 2019 at 6:37
  • I'm open one by one all the filter and I think I want use apache-shellshock, in my jail.local, what I have to write? Something like this? [apache-shellshock] enabled = true port = http,https filter = apache-auth logpath = /var/log/apache2/*error.log maxretry = 1 findtime = 600
    – alebal
    Feb 7, 2019 at 3:57


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.