Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a lot of the following error messages in my apache error log:

[Thu Dec 16 15:13:24 2010] [error] [client 168.144.92.191] File does not exist: /var/www/mydomain/fud
[Thu Dec 16 15:13:24 2010] [error] [client 168.144.92.191] File does not exist: /var/www/mydomain/flag, referer: http://lexington.craigslist.org/fud/2076870022.html
[Thu Dec 16 15:14:28 2010] [error] [client 168.144.92.191] File does not exist: /var/www/mydomain/flag, referer: http://lexington.craigslist.org/fud/2115799176.html
[Thu Dec 16 15:17:51 2010] [error] [client 168.144.92.191] File does not exist: /var/www/mydomain/fud

In my /etc/fail2ban/jail.local I have:

# Fail2Ban configuration file.
#
# This file was composed for Debian systems from the original one
#  provided now under /usr/share/doc/fail2ban/examples/jail.conf
#  for additional examples.
#
# To avoid merges during upgrades DO NOT MODIFY THIS FILE
# and rather provide your changes in /etc/fail2ban/jail.local
#
# Author: Yaroslav O. Halchenko <debian@onerussian.com>
#
# $Revision: 281 $
#

# The DEFAULT allows a global definition of the options. They can be override
# in each jail afterwards.

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip = myip
bantime  = -1
maxretry = 3

# "backend" specifies the backend used to get files modification. Available
# options are "gamin", "polling" and "auto".
# yoh: For some reason Debian shipped python-gamin didn't work as expected
#      This issue left ToDo, so polling is default backend for now
backend = polling

#
# Destination email address used solely for the interpolations in
# jail.{conf,local} configuration files.
destemail = root@localhost

#
# ACTIONS
#

# Default banning action (e.g. iptables, iptables-new,
# iptables-multiport, shorewall, etc) It is used to define 
# action_* variables. Can be overriden globally or per 
# section within jail.local file
banaction = iptables-allports

# email action. Since 0.8.1 upstream fail2ban uses sendmail
# MTA for the mailing. Change mta configuration parameter to mail
# if you want to revert to conventional 'mail'.
mta = sendmail

# Default protocol
protocol = tcp

#
# Action shortcuts. To be used to define action parameter

# The simplest action to take: ban only
action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]

# ban & send an e-mail with whois report to the destemail.
action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]
              %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s]

# ban & send an e-mail with whois report and relevant log lines
# to the destemail.
action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]
               %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s]

# Choose default action.  To change, just override value of 'action' with the
# interpolation to the chosen action shortcut (e.g.  action_mw, action_mwl, etc) in jail.local
# globally (section [DEFAULT]) or per specific section 
action = %(action_mw)s

#
# JAILS
#

#
# HTTP servers
#

[apache]

enabled = true
port  = http,https
filter  = apache-auth
logpath = /var/log/apache2/error.log
maxretry = 3

# default action is now multiport, so apache-multiport jail was left
# for compatibility with previous (<0.7.6-2) releases
[apache-multiport]

enabled   = false
port    = http,https
filter    = apache-auth
logpath   = /var/log/apache*/*error.log
maxretry  = 6

[apache-noscript]

enabled = true
port    = http,https
filter  = apache-noscript
logpath = /var/log/apache2/error.log
maxretry = 3

[apache-overflows]

enabled = false
port    = http,https
filter  = apache-overflows
logpath = /var/log/apache*/*error.log
maxretry = 2

In my /etc/fail2ban/filter.d/apache-noscript.conf I have:

failregex = [[]client <HOST>[]] (File does not exist|script not found or unable to stat): .*
failregex = [[]client <HOST>[]] script '.*' not found or unable to stat

My /var/log/fail2ban.log only has entries from when it was first started. Nothing mentioning IPs banned like my denyhosts.log does.

A check of "iptables -L -v -n" shows:

Chain INPUT (policy ACCEPT 834K packets, 145M bytes)
 pkts bytes target     prot opt in     out     source               destination         
  403 71010 fail2ban-apache  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
  403 71010 fail2ban-apache-noscript  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 574K packets, 976M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain fail2ban-apache (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  403 71010 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain fail2ban-apache-noscript (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  403 71010 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

What am I missing or what did I do wrong?

Post updated to show complete jail.local files instead of just Apache jail section and results of "iptables -L -v -n".

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

I think the second line in apache-noscript.conf is nuking the first one.

Try this:

failregex = [[]client <HOST>[]] (File does not exist|script not found or unable to stat): .*
            [[]client <HOST>[]] script '.*' not found or unable to stat
share|improve this answer
    
Thank you Mikel. I have updated the filter as you described and will keep an eye on my iptales and the fail2ban.log. –  KayakJim Dec 17 '10 at 16:27
    
Running "fail2ban-regex /var/log/apache2/error.log /etc/fail2ban/filter.d/apache-noscript.conf" does confirm that your answer is correct. With my original settings, the last statement was the only one being check. However, I still am not getting IPs blocked by fail2ban. :/ –  KayakJim Dec 17 '10 at 16:58
    
Since making the change it now appears that everything is working properly. –  KayakJim Dec 20 '10 at 15:13
add comment

Unless there is a default action I'm missing, you have no action line. Here is mine (which works):

[apache-noscript]

enabled  = true
filter   = apache-noscript
action   = iptables-multiport[name=NoScript, port="http,https"]
logpath  = /usr/local/www/sites/*/logs/*_error_log
bantime  = 172800
maxretry = 5

I've simplified the match regex to 1 line:

failregex = [[]client <HOST>[]] (File does not exist|script not found or unable to stat)

Does iptables -L -v -n at least show that the chains are properly set up?

share|improve this answer
    
I have updated my original post to show my complete jail.local instead of just the apache-noscript jail. I have also included the output of the iptables command. As I understand it, my jail.local file is setup to have a default action of action_mw, which should ban and email me. I did notice that you have iptables-multiport while my file has iptables-allports. Could that possibly be the difference? –  KayakJim Dec 17 '10 at 16:29
    
@KayakJim iptables-allports vs iptables-multiport shouldn't matter. All I can think of is turning up the logging. fail2ban-client set 4 –  Mark Wagner Dec 17 '10 at 17:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.