xsukax on XFedi

This is straight out of Claude so take it with a grain of salt but fail2banning bots hitting .php files on servers that don't run PHP seems to give good mileage, and I mean that long before the current php2shell.

# /etc/fail2ban/filter.d/apache-php-probe.conf
[Definition]
failregex = ^<HOST> -.*"(GET|POST|HEAD) [^"]*\.php[^"]*" (403|404)
ignoreregex =

and

# /etc/fail2ban/jail.d/apache-php-probe.local
[apache-php-probe]
enabled  = true
port     = http,https
filter   = apache-php-probe
logpath  = /var/log/apache2/access.log
maxretry = 1
findtime = 600
bantime  = 3600

Conversation