2

So i tried putting this in jail.local and restarting fail2ban but no go. 

[apache]

enabled = true
port    = https
filter  = apache-auth
logpath = /var/log/apache*/*error.log
maxretry = 5

[apache]

enabled = true
port    = https
filter  = apache-auth
logpath = /var/log/apache*/*access.log
maxretry = 5

I am trying to monitor access to htpasswd/htaccess.

(In this case I don't use .htaccess just htpasswd and apacheconfigs because the root directory is on another server.)

I noticed when I did

tail -f /var/log/apache2/error.log

That it would pick up my failed attempts to log in, but after 5+ failed attempts It would still take my proper login credentials. Any tips ?? Thank you !

Install Notes:

echo y | sudo apt-get install fail2ban && sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local && sudo nano /etc/fail2ban/jail.local

OS: Ubuntu Server 14.04.03 x32

Improve this question
10
  • is your iptables chain being setup by fail2ban?
    – the_velour_fog
    Jan 17, 2016 at 9:27
  • how can I check, I do a very basic fail2ban install usually. just install, create jail.local and go.
    – FreeSoftwareServers
    Jan 17, 2016 at 9:28
  • sudo iptables -S there should be a chain loaded by fail2ban - when a ban occurs it will block the HTTPS port - as per your config
    – the_velour_fog
    Jan 17, 2016 at 9:29
  • Please mention if using ubuntu. I do agree with fog you should have an iptables chain entry for fail2ban. Please mention how you installed it on the post.
    – Rui F Ribeiro
    Jan 17, 2016 at 9:34
  • If all fail2ban did was log requests - it wouldn't be much use! There should be a rule to redirect all packets to the fail2ban chain - so that if fail2ban has added any DROP rules they can take effect, before sending packets back to the INPUT chain if everything is ok
    – the_velour_fog
    Jan 17, 2016 at 9:35

1 Answer 1

Reset to default
3

I monitored fail2ban log to watch for entries for banned IP's. By not seeing my IP I knew something was wrong.

To monitor log:

 tail -f /var/log/fail2ban.log

I monitored the log fail2ban was supposed to be watching to confirm failed logins were being logged.

To monitor Apache Log:

 tail -f /var/log/apache2/error.log

In the end I Re-created jail.local which supersedes jail.conf. Jail.conf is a backup of the original configuration and jail.local is what you should modify to suit your systems needs keeping jail.conf around just for this purpose.

I then enabled each blocking configuration one by one testing via above method and confirming it works before enabling the next.

The specific apache configuation for me to enable to monitor HTAccess Apache Auth was:

 #
 # HTTP servers
 #

 [apache]

 enabled  = true
 port     = http,https
 filter   = apache-auth
 logpath  = /var/log/apache*/*error.log
 maxretry = 2

Or for NGinX

 [nginx-http-auth]

 enabled = true
 filter  = nginx-http-auth
 port    = http,https
 logpath = /var/log/nginx/error.log
 maxretry = 2
Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .