Gecko [ newweb.supercareproducts.com ]

Name	Size	Permission	Date
cpanel.yaml	1.26 KB	-rw-r--r--	2026-06-10 05:54
cwp.yaml	667 B	-rw-r--r--	2026-06-10 05:55
directadmin.yaml	694 B	-rw-r--r--	2026-06-10 05:55
exim.yaml	3.8 KB	-rw-r--r--	2026-06-29 05:50
ftp.yaml	1.33 KB	-rw-r--r--	2026-06-10 05:52
http.yaml	2.82 KB	-rw-r--r--	2026-07-06 06:49
mail.yaml	3.37 KB	-rw-r--r--	2026-06-10 05:53
rspamd.yaml	1.05 KB	-rw-r--r--	2026-06-10 05:54
ssh.yaml	1.54 KB	-rw-r--r--	2026-06-10 05:54
webuzo.yaml	822 B	-rw-r--r--	2026-06-30 07:46

Rename

jails:
  # 1. Apache / Nginx Authentication Failure
  - name: "http"
    enabled: true
    log_paths:
      - "/var/log/apache2/error.log"
      - "/var/log/httpd/error_log"
      - "/var/log/nginx/error.log"
    
    # 👇 Converted to Rules
    rules:
      # Apache
      - regexp: "\\[client (?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+)\\] (AH01630|AH01797): client denied"
      
      # Nginx
      - regexp: "client: (?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+), server: .*, request:"

max_retries: 20
    find_time: "1m"
    ban_time: "1h"
    
    actions:
      - name: "cpgblock-http"
        ban_command: '/usr/bin/cpgcli ip --temp-block {{.IP}} --reason "Blocked by {{.JailName}} due to more than {{.MaxRetry}} abusive access within {{.FindTime}} seconds" --extra " LogFile: {{.LogPath}} | Reason: {{.LogLine}}"'
        unban_command: "/usr/bin/cpgcli ip --temp-block {{.IP}} --remove"

# 2. WordPress / CMS Brute Force
  - name: "http-cms-bots"
    enabled: true
    log_paths:
      - "/etc/apache2/logs/domlogs/*/*"
      - "/var/log/nginx/access.log"
      - "/var/log/httpd/domains/*.log"
      - "/usr/local/apache/domlogs/*.log"
      - "/var/local/enhance/webserver_logs/*.log"
      - "/usr/local/lsws/logs/*.*.log"
      - "/usr/local/apps/apache2/logs/*.*.log"
      - "/usr/local/apps/nginx/var/log/*.*.log"
      - "/var/www/vhosts/system/*/logs/access*_log"

# Ignore legitimate bots to save CPU and prevent false positives
    ignore_strings:
      - "bingbot"
      - "UptimeRobot"
      - "Googlebot"
      - "facebookexternalhit"
      - "ChatGPT-User"
      - "AdsBot-Google"
      - "Google-Adwords"
      - "Jetpack"

# 👇 Converted to Rules
    rules:
      # case 1: failed attempts to execute PHP scripts
      - regexp: "^\"?(?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+)\"? .*[\" ](GET|POST) .*\\.php.* HTTP/\\d\\.\\d.*[\" ](401|403|404|406)[\" ]"
        max_retries: 15
      
      # case 2: wp-login or xmlrpc Brute Force attack
      - regexp: "^\"?(?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+)\"? .*[\" ](GET|POST) .*(wp-login\\.php|xmlrpc\\.php).*[\" ](200|307)[\" ]"
        max_retries: 10
      
      # case 3: user agent empty, script or bot
      - regexp: "^\"?(?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+)\"? .*\\.php.* \"-\" \"-\"\\s*$"

# case 4: empty referer and 404 response code without .php file request
      - regexp: "^\"?(?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+)\"? .* \"GET \\/[^ ]*\\/ HTTP\\/[0-9.]+\" \"?404\"? \\d+ \"-\" .*$"

max_retries: 15
    find_time: "1m"
    ban_time: "1h" # Ban hard for bots
    
    actions:
      - name: "cpgblock-http"
        ban_command: '/usr/bin/cpgcli ip --temp-block {{.IP}} --reason "Blocked by {{.JailName}} due to more than {{.MaxRetry}} abusive access within {{.FindTime}} seconds" --extra " LogFile: {{.LogPath}} | Reason: {{.LogLine}}"'
        unban_command: "/usr/bin/cpgcli ip --temp-block {{.IP}} --remove"