FAIL2BAN
Fail2ban monitors access logs for any application you can setup. This is instructions for interacting with dockerised FAIL2BAN, remove the docker commands to use it with host installed FAIL2BAN
It will scan for authentication errors and based on configurable amounts it will ban the IP of the machine trying to connect.
manual banning of an IP can be done like this.
sudo docker exec -t CONTAINER fail2ban-client set JAILNAME banip IP
Would like this filled out.
sudo docker exec -t fail2ban fail2ban-client set authelia-auth banip 154.16.81.113
To manually unban an IP.
sudo docker exec -t fail2ban fail2ban-client set authelia-auth unbanip 154.16.81.113
To reload config changes without restarting the container
sudo docker exec -it fail2ban fail2ban-client reload
To check your regex matches
sudo docker exec -it fail2ban fail2ban-regex /remotelogs/path/to/log "Regex here" -v --print-all-matched
So it would look something like this for my photoprism jail.
sudo docker exec -it fail2ban fail2ban-regex /remotelogs/npm/proxy-host-4_access.log "^.*401 - POST https photos\.fullmetaled\.com \"/api\/v1\/session\" \[Client <HOST>\].*\/library\/login.*$" -v --print-all-matched
-v is verbose and adds more output for debugging
--print-all-matched is going to print the log lines matching your regex