Add more fail2ban examples

dev/setup/fail2ban/filter.d/web-dolibarr-hackattempt.conf

@@ -0,0 +1,18 @@
+# Fail2Ban configuration file
+#
+# Regexp to detect try to check a couple login/password so we can add mitigation
+# on IP making too much tries.
+
+[Definition]
+
+# To test, you can inject this example into log
+# echo `date +'%Y-%m-%d %H:%M:%S'`" INFO    1.2.3.4         Hack attempt detected - xxx" >> /mypath/documents/dolibarr.log
+#
+# then
+# fail2ban-client status web-dolibarr-hackattempt
+#
+# To test rule file on a existing log file
+# fail2ban-regex /mypath/documents/dolibarr.log /etc/fail2ban/filter.d/web-dolibarr-hackattempt.conf --print-all-matched
+
+failregex = ^ [A-Z\s]+ <HOST>\s+Hack attempt detected
+ignoreregex =

dev/setup/fail2ban/filter.d/web-dolibarr-passf.conf

@@ -9,7 +9,7 @@
 # echo `date +'%Y-%m-%d %H:%M:%S'`" INFO    1.2.3.4    --- Access to GET /passwordforgotten.php - action=buildnewpassword, massaction=" >> /mypath/documents/dolibarr.log
 #
 # then
-# fail2ban-client status web-dolibarr-rulespassforgotten
+# fail2ban-client status web-dolibarr-passf
 #
 # To test rule file on a existing log file
 # fail2ban-regex /mypath/documents/dolibarr.log /etc/fail2ban/filter.d/web-dolibarr-passf.conf --print-all-matched

dev/setup/fail2ban/jail.d/web-dolibarr-bruteforce.conf

@@ -8,4 +8,4 @@ logpath = /mypath/documents/documents/dolibarr.log
 action  = %(action_mw)s
 bantime  = 86400     ; 1 day
 findtime = 3600      ; 1 hour
-maxretry = 20        ; 10 login error in 1 hour, we ban
+maxretry = 20        ; 20 login error in 1 hour, we ban

dev/setup/fail2ban/jail.d/web-dolibarr-hackattempt.conf

@@ -0,0 +1,11 @@
+[web-dolibarr-hackattempt]
+
+; rule against bruteforce hacking (login + api)
+enabled = true
+port    = http,https
+filter  = web-dolibarr-hackattempt
+logpath = /mypath/documents/documents/dolibarr.log
+action  = %(action_mw)s
+bantime  = 86400     ; 1 day
+findtime = 3600      ; 1 hour
+maxretry = 3         ; 5 hack attempts in 1 hour, we ban