2

I'm running Debian Linux. uname --all shows:

Linux xxx.xx 2.6.32-5-686 #1 SMP Tue May 13 16:33:32 UTC 2014 i686 GNU/Linux

I'm running sshd on a port that is not 22. I've updated /etc/fail2ban/jail.local to point to the new sshd port. It works fine. I can try and login to that port with an ssh client, enter the wrong password several times, then it locks that IP address out via iptables.

However, I am also running an apache webserver, that gets hit all the time with attempts like this (from /var/log/apache2/error.log):

[Sun Nov 02 08:03:13 2014] [error] [client 178.239.62.113] File does not exist: /var/www/html/muieblackcat
[Sun Nov 02 08:03:14 2014] [error] [client 178.239.62.113] File does not exist: /var/www/html/phpMyAdmin
[Sun Nov 02 08:03:16 2014] [error] [client 178.239.62.113] File does not exist: /var/www/html/phpmyadmin
[Sun Nov 02 08:03:16 2014] [error] [client 178.239.62.113] File does not exist: /var/www/html/pma
[Sun Nov 02 08:03:16 2014] [error] [client 178.239.62.113] File does not exist: /var/www/html/myadmin
[Sun Nov 02 08:03:17 2014] [error] [client 178.239.62.113] File does not exist: /var/www/html/MyAdmin

I was trying to setup fail2ban to read error.log and ban the offending IP addresses via iptables, but I can't get it to work.

Like I said, it works great for ssh, but not for apache. Here is my jail.local:

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip = 127.0.0.1/8 67.159.128.0/19
# bantime = 21600 == 6 hours
bantime  = 21600

#findtime, in seconds.  300 = 5 minutes, 10800 = 3 hours
findtime = 10800
maxretry = 3

# "backend" specifies the backend used to get files modification. Available
# options are "gamin", "polling" and "auto".
# yoh: For some reason Debian shipped python-gamin didn't work as expected
#      This issue left ToDo, so polling is default backend for now
backend = auto

#
# Destination email address used solely for the interpolations in
# jail.{conf,local} configuration files.
destemail = root@localhost

#
# ACTIONS
#

# Default banning action (e.g. iptables, iptables-new,
# iptables-multiport, shorewall, etc) It is used to define 
# action_* variables. Can be overriden globally or per 
# section within jail.local file
banaction = iptables-multiport

# email action. Since 0.8.1 upstream fail2ban uses sendmail
# MTA for the mailing. Change mta configuration parameter to mail
# if you want to revert to conventional 'mail'.
mta = sendmail

# Default protocol
protocol = tcp

#
# Action shortcuts. To be used to define action parameter

# The simplest action to take: ban only
action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]

# ban & send an e-mail with whois report to the destemail.
action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]
          %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s]

# ban & send an e-mail with whois report and relevant log lines
# to the destemail.
action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]
           %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=

%(logpath)s]

# Choose default action.  To change, just override value of 'action' with the
# interpolation to the chosen action shortcut (e.g.  action_mw, action_mwl, etc) in     

jail.local
# globally (section [DEFAULT]) or per specific section 
action = %(action_)s

#
# JAILS
#

# Next jails corresponds to the standard configuration in Fail2ban 0.6 which
# was shipped in Debian. Enable any defined here jail by including
#
# [SECTION_NAME] 
# enabled = true

#
# in /etc/fail2ban/jail.local.
#
# Optionally you may override any other parameter (e.g. banaction,
# action, port, logpath, etc) in that section within jail.local

# we are banning port xxxxx instead of ssh because I use port xxxxx instead
[ssh]

enabled = true
port    = xxxxx
filter  = sshd
logpath  = /var/log/auth.log
findtime = 300
maxretry = 4

#
# HTTP servers
#

[apache]

enabled = true
port    = http,https
filter  = apache-auth
logpath = /var/log/apache2/*error.log
findtime = 10800
maxretry = 3

# default action is now multiport, so apache-multiport jail was left
# for compatibility with previous (<0.7.6-2) releases
[apache-multiport]

enabled   = true
port      = http,https
filter    = apache-auth
logpath   = /var/log/apache2/*error.log
findtime = 300
maxretry  = 3

[apache-noscript]

enabled = true
port    = http,https
filter  = apache-noscript
logpath = /var/log/apache2/*error.log
findtime = 300
maxretry = 4

[apache-overflows]

enabled = true
port    = http,https
filter  = apache-overflows
logpath = /var/log/apache2/*error.log
findtime = 300
maxretry = 2

[apache-misc]

enabled = true
port = http,https
filter = apache-misc
logpath = /var/log/apache2/*error.log
findtime = 10800
maxretry = 2

Here is my /etc/fail2ban/apache-misc file:

[Definition]

failregex = <HOST>.*"[A-Z]* /(cms|user|muieblackcat|db|cpcommerce|wp-login|joomla|    awstatstotals|wp-content|wp-includes|pma|phpmyadmin|myadmin|mysql|mysqladmin|sqladmin|    mypma|admin|xampp|mysqldb|pmadb|phpmyadmin1|phpmyadmin2).*"
        <HOST>.*\" (502|500|417|416|415|414|413|412|404|405|403|401|400)

ignoreregex = .*\"GET \/(press|mailto|domestic|word).*

Can anyone offer any suggestions?

  • Are you sure you want to be doing this? One of my sites gets File Not Found messages for most visitors as it doesn't have a favicon in all the required formats. You'll need to make sure that all types of favicons are covered to make sure you don't lock out genuine visitors - all Apple devices seem to need their own peculiar versions of icon files, depending on model! IE needs favicon.ico etc, etc. Your fail2ban setup will need to be quite specific as to which File Not Found messages to ban. – garethTheRed Nov 3 '14 at 6:51
0

I would recommend starting with a small subset of regex conditions using the recommended syntax as follows...

failregex = [[]client (?P<host>\S*)[]] File does not exist: .*/(muieblackcat|phpmyadmin)

You can always build on it and can easily test your regex. Don't forget to reload fail2ban once you make the changes.

  • Thanks! I put your failregex line in above, restarted fail2ban, and my /var/log/fail2ban.log file shows: fail2ban.actions: WARNING [apache-misc] Ban 1.2.3.4 (ip address of my smartphone). But for some reason, I can still "get in" from my smartphone. Almost like iptables isn't working. I know it is when I try it via an SSH client. – Jim Earl Nov 4 '14 at 3:39
  • Have you checked your iptables rules to see if there are any issues there? – cherrysoft Nov 4 '14 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.