fail2ban/fail2ban — pull request #12 by sciunto (2011-12-24 21:02:16+00:00)
Title: Lighttpd: new rule for authentification failures

A patch has been accepted 1 year ago in lighttpd (http://lists.pld-linux.org/mailman/pipermail/pld-devel-en/2010-May/021637.html) to write in error.log the IP when authentification failures occur.

I think it it worth to catch such attempt since it could be a brute-force attack.
I suggest in this patch a new rule and the suitable modification in jail.conf which handle this situation.