Basically at the moment our server is set a little too secure and fail2ban is banning users who are just browsing the website even if there is just a missing image for example.

Which of the following apache settings do I need to disable to stop this from happening:

[apache]
enabled = true
port    = http,https
filter  = apache-auth
action  = iptables[name=httpd, port=http, protocol=tcp]
  sendmail-whois[name=httpd, dest="%(destemail)s", sender=fail2ban@server.edu]
logpath = /var/log/apache*/*error.log
maxretry = 3

[apache-ssl]
enabled = true
port    = http,https
filter  = apache-auth
action   = iptables[name=httpd, port=https, protocol=tcp]
  sendmail-whois[name=httpd, dest="%(destemail)s", sender=fail2ban@server.edu]
logpath = /var/log/apache*/*error.log
maxretry = 3

[apache-multiport]
enabled   = true
port      = http,https
filter    = apache-auth
action   = iptables[name=httpd, port=http, protocol=tcp]
logpath   = /var/log/apache*/*error.log
maxretry  = 3

[apache-noscript]
enabled = true
port    = http,https
filter  = apache-noscript
action  = iptables[name=httpd, port=http, protocol=tcp]
  sendmail-whois[name=httpd, dest="%(destemail)s", sender=fail2ban@server.edu]
logpath = /var/log/apache*/*error.log
maxretry = 20
bantime  = 300 #5mins

[apache-noscript-ssl]
enabled = true
port    = http,https
filter  = apache-noscript
action  = iptables[name=httpd, port=https, protocol=tcp]
  sendmail-whois[name=httpd, dest="%(destemail)s", sender=fail2ban@server.edu]
logpath = /var/log/apache*/*error.log
maxretry = 20
bantime  = 300 #5mins

[apache-overflows]
enabled = true
port    = http,https
filter  = apache-overflows
action  = iptables[name=httpd, port=http, protocol=tcp]
  sendmail-whois[name=httpd, dest="%(destemail)s", sender=fail2ban@server.edu]
logpath = /var/log/apache*/*error.log
maxretry = 3

[apache-overflows-ssl]
enabled = true
port    = http,https
filter  = apache-overflows
action  = iptables[name=httpd, port=https, protocol=tcp]
  sendmail-whois[name=httpd, dest="%(destemail)s", sender=fail2ban@server.edu]
logpath = /var/log/apache*/*error.log
maxretry = 3
link|improve this question

3  
Look in the fail2ban log for the reason it was banned. It will tell you what rule triggered the ban. – TheCompWiz Jan 25 at 16:03
I was looking in the apache log file and not fail2ban. This shows clearly it is the apache-overflows that is causing the problem. – John Magnolia Jan 25 at 16:06
2  
@TheCompWiz Could you post that as an Answer please? Thank you! – Chris S Jan 25 at 16:32
feedback

1 Answer

up vote 2 down vote accepted

Check the fail2ban log for the reasons it banned a user.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.