[apache-w00tw00t]
enabled  = true
filter   = apache-w00tw00t
action   = iptables-allports[name=w00tw00t]
           mail-whois[name=w00tw00t, dest=root, sender=fail2ban@myserver.org]
logpath  = /var/log/httpd/access_log
maxretry = 3
## -- don't unban
bantime  = -1

## --------- more apache blocks ---------
[apache-sniffers]
enabled  = false
filter   = apache-sniffers
action   = iptables-allports[name=sniffers]
           mail-whois-lines[name=sniffers, dest=root, sender=fail2ban@myserver.org,logpath=/var/log/httpd/access_log]
logpath  = /var/log/httpd/access_log
maxretry = 3
bantime  = -1

[apache-phpmyadmin]
enabled  = true
port     = http,https
filter   = apache-phpmyadmin
action   = iptables-allports[name=phpmyadmin]
           mail-whois-lines[name=phpmyadmin, dest=root, sender=fail2ban@myserver.org, logpath=/var/log/httpd/access_log]
logpath  = /var/log/httpd/access_log
maxretry = 3
bantime  = -1

• fail2ban looks in the apache logfile (the logpath entry)
  
• A regular expression is in the apache-w00tw00t.conf file (the filter entry), in the filter.d subdirectory,
  
• once there are more than three matches (the maxretry setting)...
  
• two actions are performed: iptables-allport.conf and mail-whois.conf (the action directive), both located in the action.d directory
  
• the bantime says how long the block should be for -- in this case, it's permanent

[Definition]

# Option:  failregex
# Notes.:  regex to match the w00tw00t scan messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching.
# Values:  TEXT
## *** examples: ***
##<HOST> - - [29/Apr/2008:22:54:08 +0200] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 326
##89.19.27.114 - - [02/Oct/2009:23:16:25 +0200] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 311 "-" "-"
#failregex = ^<HOST> -.*"GET \/w00tw00t\.at\.ISC\.SANS\.DFind\:\).*".*
## -- amended this to remove DFind\:\).*".* and SANS.test0:)
failregex = ^<HOST> -.*"GET \/w00tw00t\.at\.ISC\.SANS\..*\:\).*".*

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT

ignoreregex =

• iptables-allport - adds an IPtables block for ALL ports, essentially runs "iptables -A INPUT -s ThatIPAddress -j DROP"
  
• mail-whois - sends an email, but also includes the WHOIS information for that IP address so I can extract the abuse email addres and forward it on.
  
• mail-whois-list - as above, but also includes the logfile lines, so evidence can be directly forwarded. I was going to amend one of the files in the action.d directory, only to find someone had beaten me to it!

mail-whois-lines[name=phpmyadmin, dest=root, sender=fail2ban@myserver.org, logpath=/var/log/httpd/access_log]

• The name of the jail is "phpmyadmin" which features in the email notification (I don't know if spaces are permitted here)
  
• The destination email is "root" (which gets forwarded off this server via the /etc/aliases file)
  
• The sender is.. well, you can work that out, and you can also work out that I've not included my real email address there. By using a specific sender, I can then filter on the "From:" field in mail headers.
  
• The logpath tells grep which file to search and pull out matching lines for evidence. For some reason it wouldn't accept the path already set, so needed to be specified again. I noted in action.d/mail-whois-lines.conf that this field is set to "/dev/null", but I think that's intended as a default setting.

#!/bin/bash
# recordtv.sh 

HOME=/home/user

if [ -z $1 ] || [ -z $2 ]
then echo "Usage: recordtv 'wait time' 'duration'" "Use h,m,s suffix.  Ex recordtv 10m 1h" 
exit
else
echo "Start recording in $1 for $2"
sleep $1
mplayer /dev/video0 -really-quiet -dumpstream -dumpfile $HOME/recordedtv.out &
sleep $2
killall mplayer
fi
exit