add fail2ban rules

fail2ban/filter.d/nginx-access.conf

+# Fail2Ban configuration file
+#
+# Author: Vitaly Lipatov
+#
+# $Revision: 728 $
+#
+
+[Definition]
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+# Values: TEXT
+#
+failregex = ^<HOST> - -.*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+#ignoreregex = 

fail2ban/filter.d/nginx-access404.conf

+# Fail2Ban configuration file
+#
+# Author: Vitaly Lipatov
+#
+# $Revision: 728 $
+#
+
+[Definition]
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+# Values: TEXT
+#
+failregex = ^<HOST> - -.*HTTP/1\.[01]\" 404 .* from.*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+#ignoreregex = 

fail2ban/filter.d/nginx-braccess.conf

+# Fail2Ban configuration file
+#
+# Author: Vitaly Lipatov
+#
+# $Revision: 728 $
+#
+
+[Definition]
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+# Values: TEXT
+#
+failregex = ^<HOST> - -.*499 0 from.*$
+
+# Option:  ignoreregex
+# Notes.:  regex to ignore. If this regex matches, the line is ignored.
+# Values:  TEXT
+#
+#ignoreregex = 

fail2ban/test.d/nginx-access

+46.188.125.221 - - [13/Nov/2015:15:49:41 +0300] "GET /audio/undefined HTTP/1.1" 499 0 from "http://azbyka.ru/audio/besedy-na-evangelie-ot-marka.html" - "azbyka.ru"
+

fail2ban/test.d/nginx-access404

+217.69.133.85 - - [03/Dec/2015:21:51:53 +0300] "GET /otechnik/Savva_Ostapenko/polnoe-sobranie-propovedej-i-pouchenij-shiigumena-savvy-soderzhanie/1_7 HTTP/1.1" 404 5112 from "-" 0.177 "azbyka.ru" -
+217.69.133.223 - - [03/Dec/2015:21:51:54 +0300] "GET /biblia/?Rom.111:31 HTTP/1.1" 404 5112 from "-" 0.246 "azbyka.ru" -
+217.69.133.218 - - [03/Dec/2015:21:52:06 +0300] "GET /duhovnikforum/archive/index.php/t-2068.html HTTP/1.1" 404 5112 from "-" 0.187 "azbyka.ru" -
+217.69.133.216 - - [03/Dec/2015:21:52:13 +0300] "GET /otechnik/Savva_Ostapenko/polnoe-sobranie-propovedej-i-pouchenij-shiigumena-savvy-soderzhanie/4_19_3 HTTP/1.1" 404 5112 from "-" 0.246 "azbyka.ru" -
+40.77.167.46 - - [03/Dec/2015:21:52:26 +0300] "GET /otechnik/pravila/pravila_i_sobory_pravoslavnoj_cerkvi_kanonicheskoe_poslanie_svjatago_dionisija_aleksandrijskago/20_3 HTTP/1.1" 404 5112 from "-" 0.412 "azbyka
+79.165.1.221 - - [03/Dec/2015:21:52:40 +0300] "GET /biblia/?Tov.15:14 HTTP/1.1" 404 14554 from "http://azbyka.ru/biblia/?Tov.15:14303559" 1.212 "azbyka.ru" -
+217.69.133.222 - - [03/Dec/2015:21:52:53 +0300] "GET /biblia/?Mt.79+%D0%B7%D0%B0%D1%87.,+19:16-26 HTTP/1.1" 404 5112 from "-" 0.193 "azbyka.ru" -
+109.108.245.145 - - [03/Dec/2015:21:52:57 +0300] "GET /video/tolkovanie-biblii/non HTTP/1.0" 404 14554 from "http://azbyka.ru/video/tolkovanie-biblii/" 0.484 "azbyka.ru" -
+185.78.33.129 - - [03/Dec/2015:21:53:09 +0300] "GET /forum/blog_attachment.php?attachmentid=613&d=1297706092 HTTP/1.1" 404 5112 from "http://imgplusdb.com/derevenskaya-cerkov-zimoy-foto" 0.232 "azbyka.ru" -
+217.69.133.221 - - [03/Dec/2015:21:53:14 +0300] "GET /duhovnikforum/archive/index.php/t-3955.html HTTP/1.1" 404 5112 from "-" 0.305 "azbyka.ru" -
+213.191.11.65 - - [03/Dec/2015:21:53:23 +0300] "GET /znakomstva/cle/images/icons/6...%20%3Ca%20href='javascript:void(0);'%20id='adesc'%20onclick= HTTP/1.1" 404 5112 from "http://azbyka.ru/znakomstva/anketa/elena
+213.191.11.65 - - [03/Dec/2015:21:53:24 +0300] "GET /znakomstva/cle/images/icons/6...%20%3Ca%20href='javascript:void(0);'%20id='adesc'%20onclick= HTTP/1.1" 404 5112 from "http://azbyka.ru/znakomstva/anketa/elena
+217.69.133.217 - - [03/Dec/2015:21:53:27 +0300] "GET /fiction/nyanya-iz-moskvy/comments HTTP/1.1" 404 5112 from "-" 3.098 "azbyka.ru" -
+46.159.97.14 - - [03/Dec/2015:21:53:27 +0300] "GET /video/asketika-dlya-miryan/non HTTP/1.1" 404 5112 from "http://azbyka.ru/video/asketika-dlya-miryan/" 0.532 "azbyka.ru" -
+78.111.186.178 - - [03/Dec/2015:21:53:30 +0300] "GET /browserconfig.xml HTTP/1.1" 404 5112 from "-" - "azbyka.ru" -
+157.55.39.114 - - [03/Dec/2015:21:53:40 +0300] "GET /video/%D0%BC%D0%B5%D1%EF%BF%BD%D0%BA%D0%B0/%d0%b8%d1%81%d0%bb%d0%b0%d0%bc/ HTTP/1.1" 404 5112 from "-" 0.521 "azbyka.ru" -
+141.0.14.248 - - [03/Dec/2015:21:53:40 +0300] "GET /soundmanager/swf/soundmanager2_flash9_debug.swf HTTP/1.1" 404 5112 from "http://azbyka.ru/" - "azbyka.ru" -
+188.18.226.159 - - [03/Dec/2015:21:53:51 +0300] "GET /theme/image.php?theme=pravkurs&component=core&image=i%2Fcourse HTTP/1.1" 404 5112 from "http://azbyka.ru/pravkurs/theme/styles.php?theme=pravkurs&rev=1447815
+157.55.39.114 - - [03/Dec/2015:21:53:53 +0300] "GET /otechnik/Pravila_Svjatyh/pravila_i_sobory_pravoslavnoj_cerkvi_pravila_feofila_aleksandrijskogo/204 HTTP/1.1" 404 5112 from "-" 0.529 "azbyka.ru" -
+40.77.167.47 - - [03/Dec/2015:21:54:02 +0300] "GET /otechnik/Ioann_Kronshtadtskij/pisma/Igum_Taisii23_02_03 HTTP/1.1" 404 5112 from "-" 0.391 "azbyka.ru" -
+79.165.1.221 - - [03/Dec/2015:21:54:17 +0300] "GET /biblia/?Ezr.21 HTTP/1.1" 404 14554 from "http://azbyka.ru/biblia/?Ezr.2119166" 0.204 "azbyka.ru" -

fail2ban/test.d/nginx-braccess

+46.188.125.221 - - [13/Nov/2015:15:49:41 +0300] "GET /audio/undefined HTTP/1.1" 499 0 from "http://azbyka.ru/audio/besedy-na-evangelie-ot-marka.html" - "azbyka.ru"
+