Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Basically at the moment our server is set a little too secure and fail2ban is banning users who are just browsing the website even if there is just a missing image for example.

Which of the following apache settings do I need to disable to stop this from happening:

[apache]
enabled = true
port    = http,https
filter  = apache-auth
action  = iptables[name=httpd, port=http, protocol=tcp]
  sendmail-whois[name=httpd, dest="%(destemail)s", sender=fail2ban@server.edu]
logpath = /var/log/apache*/*error.log
maxretry = 3

[apache-ssl]
enabled = true
port    = http,https
filter  = apache-auth
action   = iptables[name=httpd, port=https, protocol=tcp]
  sendmail-whois[name=httpd, dest="%(destemail)s", sender=fail2ban@server.edu]
logpath = /var/log/apache*/*error.log
maxretry = 3

[apache-multiport]
enabled   = true
port      = http,https
filter    = apache-auth
action   = iptables[name=httpd, port=http, protocol=tcp]
logpath   = /var/log/apache*/*error.log
maxretry  = 3

[apache-noscript]
enabled = true
port    = http,https
filter  = apache-noscript
action  = iptables[name=httpd, port=http, protocol=tcp]
  sendmail-whois[name=httpd, dest="%(destemail)s", sender=fail2ban@server.edu]
logpath = /var/log/apache*/*error.log
maxretry = 20
bantime  = 300 #5mins

[apache-noscript-ssl]
enabled = true
port    = http,https
filter  = apache-noscript
action  = iptables[name=httpd, port=https, protocol=tcp]
  sendmail-whois[name=httpd, dest="%(destemail)s", sender=fail2ban@server.edu]
logpath = /var/log/apache*/*error.log
maxretry = 20
bantime  = 300 #5mins

[apache-overflows]
enabled = true
port    = http,https
filter  = apache-overflows
action  = iptables[name=httpd, port=http, protocol=tcp]
  sendmail-whois[name=httpd, dest="%(destemail)s", sender=fail2ban@server.edu]
logpath = /var/log/apache*/*error.log
maxretry = 3

[apache-overflows-ssl]
enabled = true
port    = http,https
filter  = apache-overflows
action  = iptables[name=httpd, port=https, protocol=tcp]
  sendmail-whois[name=httpd, dest="%(destemail)s", sender=fail2ban@server.edu]
logpath = /var/log/apache*/*error.log
maxretry = 3
share|improve this question
3  
Look in the fail2ban log for the reason it was banned. It will tell you what rule triggered the ban. –  TheCompWiz Jan 25 '12 at 16:03
    
I was looking in the apache log file and not fail2ban. This shows clearly it is the apache-overflows that is causing the problem. –  John Magnolia Jan 25 '12 at 16:06
2  
@TheCompWiz Could you post that as an Answer please? Thank you! –  Chris S Jan 25 '12 at 16:32
add comment

1 Answer

up vote 2 down vote accepted

Check the fail2ban log for the reasons it banned a user.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.