# Fail2Ban jail: generic vulnerability/secrets-scanner burst detection.
#
# Install as: /etc/fail2ban/jail.d/apache-vhost-scan-burst.local
#
# Why jail.d/*.local and not jail.d/*.conf: on a panel-managed host (e.g.
# ISPConfig3), the panel owns /etc/fail2ban/jail.local and rewrites it on
# update.  Files in jail.d/ are left alone, and the .local suffix is read
# last, so nothing in that file's [DEFAULT] can silently override the
# values set here.  On a hand-managed host with no such panel, jail.d/*.local
# still works the same way and costs nothing.

[apache-vhost-scan-burst]
enabled  = true

# MUST equal the filter's filename without .conf, i.e.
# /etc/fail2ban/filter.d/apache-vhost-scan-burst.conf
filter   = apache-vhost-scan-burst

logpath  = /var/log/apache2/other_vhosts_access.log

# This host is SysV, not systemd - never let this become "systemd".
backend  = auto

port     = http,https
protocol = tcp

# Confirmed 2026-09-15: real users on this host rarely exceed ~1 request/
# minute, while the observed scan burst was ~210 requests in ~2 seconds.
# maxretry=18/findtime=45s sits in the middle of the agreed 15-20 retries
# in a 30-60s window - tune within that range for your own traffic mix.
maxretry = 18
findtime = 45s
bantime  = 1d

# Repeat offenders get progressively longer bans, capped at a week.
# Requires fail2ban >= 0.11 - delete these three lines on 0.9/0.10.
bantime.increment = true
bantime.factor    = 2
bantime.maxtime   = 1w

# Add your own office/VPN addresses here if you want to be exempt outright.
#ignoreip = 127.0.0.1/8 ::1

# banaction is deliberately not set, so this jail uses whatever
# jail.local's [DEFAULT] already configures on this host - panel-managed
# or not - and stays consistent with the existing firewall (iptables/
# nftables/ufw).