2

So i tried putting this in jail.local and restarting fail2ban but no go.

[apache]

enabled = true
port    = https
filter  = apache-auth
logpath = /var/log/apache*/*error.log
maxretry = 5

[apache]

enabled = true
port    = https
filter  = apache-auth
logpath = /var/log/apache*/*access.log
maxretry = 5

I am trying to monitor access to htpasswd/htaccess.

(In this case I don't use .htaccess just htpasswd and apacheconfigs because the root directory is on another server.)

I noticed when I did

tail -f /var/log/apache2/error.log

That it would pick up my failed attempts to log in, but after 5+ failed attempts It would still take my proper login credentials. Any tips ?? Thank you !

Install Notes:

echo y | sudo apt-get install fail2ban && sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local && sudo nano /etc/fail2ban/jail.local 

OS: Ubuntu Server 14.04.03 x32

  • is your iptables chain being setup by fail2ban? – the_velour_fog Jan 17 '16 at 9:27
  • how can I check, I do a very basic fail2ban install usually. just install, create jail.local and go. – FreeSoftwareServers Jan 17 '16 at 9:28
  • sudo iptables -S there should be a chain loaded by fail2ban - when a ban occurs it will block the HTTPS port - as per your config – the_velour_fog Jan 17 '16 at 9:29
  • all I see is ufw rules, not a single mention of fail2ban in iptables, but there are no currently banned users, but I assume the rule is static and banned users just show in fail2ban's logs. – FreeSoftwareServers Jan 17 '16 at 9:31
  • Please mention if using ubuntu. I do agree with fog you should have an iptables chain entry for fail2ban. Please mention how you installed it on the post. – Rui F Ribeiro Jan 17 '16 at 9:34
1

I monitored fail2ban log to watch for entries for banned IP's. By not seeing my IP I knew something was wrong.

To monitor log:

 tail -f /var/log/fail2ban.log

I monitored the log fail2ban was supposed to be watching to confirm failed logins were being logged.

To monitor Apache Log:

 tail -f /var/log/apache2/error.log

In the end I Re-created jail.local which supersedes jail.conf. Jail.conf is a backup of the original configuration and jail.local is what you should modify to suit your systems needs keeping jail.conf around just for this purpose.

I then enabled each blocking configuration one by one testing via above method and confirming it works before enabling the next.

The specific apache configuation for me to enable to monitor HTAccess Apache Auth was:

 #
 # HTTP servers
 #

 [apache]

 enabled  = true
 port     = http,https
 filter   = apache-auth
 logpath  = /var/log/apache*/*error.log
 maxretry = 2

Or for NGinX

 [nginx-http-auth]

 enabled = true
 filter  = nginx-http-auth
 port    = http,https
 logpath = /var/log/nginx/error.log
 maxretry = 2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.