nginx-auth-main.conf

# setup /etc/fail2ban/filter.d/nginx-auth-main.conf
# fail2ban-regex /usr/local/nginx/logs/*error*.log /etc/fail2ban/filter.d/nginx-auth-main.conf --print-all-matched

[Definition]

failregex = ^ \[error\] \d+#\d+: \*\d+ user "\S+":? (password mismatch|was not found in ".*"), client: <HOST>, server: \S*, request: "\S+ \S+ HTTP/\d+\.\d+", host: "\S+"(, referrer: "\S+")?\s*$
ignoreregex = 
datepattern = {^LN-BEG}

# DEV NOTES:
# Based on samples in https://github.com/fail2ban/fail2ban/pull/43/files
# Extensive search of all nginx auth failures not done yet.
# 
# Author: Daniel Black