We are using fail2ban on our web-facing servers to block IP addresses that repeatedly fail to authenticate properly. Our normal bantime hereby is one hour; IPs that have already been banned multiple times are blocked for a day using the
recidive jail included in the fail2ban example config.
This block duration of one day was chosen in order not to affect dynamic IPs too much, especially considering the
recursive jail does not block specific ports, but all incoming connections. However, we would like to ban very persistent attackers for a longer period of time. Currently, this is achieved by a custom
super-recidive filter and jail. This jail blocks for a whole week every host which has been banned by
recidive twice (this IP is obviously not dynamically assigned).
Ideally however, I would like to ban for a week every IP which has been banned by
recidive in the past (say, one week) and which after being unbanned is banned again by whatever jail. I know something like this must be possible with a complex
failregex including backreferences - but is there a more elegant way to do this?