# HG changeset patch
# User IBBoard <dev@ibboard.co.uk>
# Date 1428740472 0
# Node ID 5b9ba754d2ff749ee7531eecafc66193773a0e60
# Parent  29d330d2056a7370bca0dc02162de5a5e7d5b261
Update the "repeat offender" rule so that a) it works, and b) "already banned"* also counts as repeat

* i.e. quick bombardments that get multiple hits in the rules before Fail2Ban had a chance to process them

diff -r 29d330d2056a -r 5b9ba754d2ff common/fail2ban/ibb-repeat-offender.conf
--- a/common/fail2ban/ibb-repeat-offender.conf	Sun Mar 22 18:26:06 2015 +0000
+++ b/common/fail2ban/ibb-repeat-offender.conf	Sat Apr 11 08:21:12 2015 +0000
@@ -16,7 +16,8 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values: TEXT
 #
-failregex = fail2ban.actions:\s+WARNING\s+\[(?:.*)\]\s+Ban\s+<HOST>
+failregex = WARNING\s+\[(?:.*)\]\s+Ban\s+<HOST>
+            INFO\s+\[(?:.*)\]\s+<HOST> already banned
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.