# Fail2Ban jail: known bad-bot/scraper User-Agent strings, vhost-log variant.
#
# Install as: /etc/fail2ban/jail.d/apache-vhost-badbots.local
#
# Why jail.d/*.local and not jail.d/*.conf: on a panel-managed host (e.g.
# ISPConfig3), the panel owns /etc/fail2ban/jail.local and rewrites it on
# update.  Files in jail.d/ are left alone, and the .local suffix is read
# last, so nothing in that file's [DEFAULT] can silently override the
# values set here.  On a hand-managed host with no such panel, jail.d/*.local
# still works the same way and costs nothing.

[apache-vhost-badbots]
enabled  = true

# MUST equal the filter's filename without .conf, i.e.
# /etc/fail2ban/filter.d/apache-vhost-badbots.conf
filter   = apache-vhost-badbots

logpath  = /var/log/apache2/other_vhosts_access.log

# This host is SysV, not systemd - never let this become "systemd".
backend  = auto

port     = http,https
protocol = tcp

# maxretry = 1, matching the stock apache-badbots jail: a single hit against
# the known-bad-UA list is already high-confidence, there is nothing to
# average out by waiting for a second one.
maxretry = 1
findtime = 1d
bantime  = 48h

# Requires fail2ban >= 0.11 - delete these three lines on 0.9/0.10.
bantime.increment = true
bantime.factor    = 2
bantime.maxtime   = 1w

# Add your own office/VPN addresses here if you want to be exempt outright.
#ignoreip = 127.0.0.1/8 ::1

# banaction is deliberately not set, so this jail uses whatever
# jail.local's [DEFAULT] already configures on this host - panel-managed
# or not - and stays consistent with the existing firewall (iptables/
# nftables/ufw).