I'm trying to get fail2ban to block certain bad bots from hammering my website. I started off with just enabling the default "apache-badbots" in jail.local (I did change the logpath to match my own logs and the user it sends reports to)
enabled = true
filter = apache-badbots
action = iptables-multiport[name=BadBots, port="http,https"]
sendmail-buffered[name=BadBots, lines=5, dest=jisti]
logpath = /var/logs/httpd/access_log
bantime = 172800
maxretry = 1
I restarted fail2ban and got an email saying the jail started. However as I was watching the logs one of the bad bots hammered the site and fail2ban did nothing.
So I checked out the apache-badbots.conf in filters. I came to the conclusion the regex probably wasn't matching the custom log format I was using, nor was it actually looking for the specific bad bot that was hammering my site. I tinkered with failregex and then tested with
fail2ban-regex /var/log/httpd/access_log /etc/fail2ban/filter.d/apache-badbots.conf
This reported success and over 300 matched. Woohoo I thought. I restarted fail2ban. Shortly thereafter I saw the bot hammering the site again and fail2ban doing nothing. I checked iptables just to see if it was doing something but getting the iptables rule wrong
iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N fail2ban-BadBots
-N fail2ban-SSH
-N fail2ban-php-url-open
-A INPUT -p tcp -m tcp --dport 22 -j fail2ban-SSH
-A fail2ban-BadBots -j RETURN
-A fail2ban-SSH -j RETURN
-A fail2ban-php-url-open -j RETURN
Also I should mention when it blocks SSH attacks, it does correctly add iptables rules. So something does work just not apache-badbots.
I next tried to set fail2ban's logging to debug and read through fail2ban.log. Unfortunately there was nothing in there that helped. There were log entries for the jail starting and defining the correct regex as well as defining the actions. However there were no log entries for the apache-badbots jail matching and taking action against any IP.
Also I'll mention that the SSH jail seems to work just fine, so fail2ban does work on the box, just not the apache-badbots jail.
What do I need to do to get it to work?
