3

I have been banging my head all day trying to match my regex filter to my access.log with no luck. I have installed fail2ban on a gentoo server and its running fine (i manually baned my own IP and it works) but fail2ban regex fails and return 0 results with filters even my site has heavyload attack right now and last coupleof days.

by the way i dont use iptables software on my server (do i need to install one in order for fail2ban to work?) i guess fail2ban cant read my logformat or my time format, i tried to tweak everything but no luck, any help is very very appreciated

Here is my jail.local

[INCLUDES]
before = paths-common.conf
[DEFAULT]
action=%(action_mwl)s
ignoreip = 127.0.0.1/8 192.168.99.25
ignorecommand =
bantime  = 86400
findtime  = 300
backend = gamin

[wp-login]
enabled = true
filter = wp-login
banaction=iptables-allports
logpath = /var/log/nginx/localhost*access_log
bantime = 7200
maxretry = 1


[nginx-nohome]
enabled=true
port=http,https
filter=nginx-nohome
logpath=/var/log/nginx/localhost.error.log
bantime=86400
maxretry=2

[nginx-dos]
enabled = true
port    = http,8090,8080
filter  = nginx-dos
logpath = /var/log/nginx/localhost.access*log
findtime = 30
bantime  = 172800
maxretry = 140

[nginx-login]
enabled = true
filter = nginx-login
action = iptables-multiport[name=NoLoginFailures, port="http,https"]
logpath = /var/log/messages
bantime = 7200
maxretry = 6

[nginx-req-limit]
enabled = true
filter = nginx-req-limit
action = iptables-multiport[name=ReqLimit, port="http,https", protocol=tcp]
logpath = /var/log/nginx/localhost.access*log
findtime = 600
bantime = 7200
maxretry = 10

and here is my filters:

[Definition]i
failregex = limiting requests, excess:.* by zone.*client: <HOST>

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
~

[Definition]
failregex = ^<HOST> -.*GET */wp-login* HTTP/1\.."
ignoreregex =

#
[Definition]
failregex = ^<HOST> -.*GET.*(\.php|\.asp|\.exe|\.pl|\.cgi|\scgi)
ignoreregex =


[Definition]
failregex = ^<HOST> -.*GET .*/~.*
ignoreregex =
~

On nginx side, this is my log format syntax and output:

log format

 log_format main
 '[$time_local] - $remote_addr '
 '"$request" $status $bytes_sent '
 '"$http_referer" "$http_user_agent" ';

accesslog output:

[01/Oct/2015:09:15:52 +0800] - 60.18.17.206, 113.21.15.23 "POST/httprl_async_function_callback?count=121 HTTP/1.1" 200 1351 "-" "Drupal (+http://drupal.org/)" "-"

errorlog format:

2015/09/22 00:04:06 [error] 7418#0: *287 FastCGI sent in stderr: "Primary    scriptunknown", client: 192.168.99.76, server: www.sams.com, request: "GET/city HTTP/1.0", host: "www.sams.com"

UPDATE: My site does not use wordpress but i am getting millions of wordpress related link link wp-login.php that i want to block, there are many agressive malicious search bots, ads bots, spider also that breaks my server, i want to block

1 Answer 1

2

So it seems that you're not very familiar with regexes, you have a steep learning curve. The fail2ban utility uses python regexes, it's worth reading that page a little.

Part of the problem you are having is this part of your failregex

^<HOST>

This says look for the pre-defined <HOST> regex at the beginning of the line (or immediately after a newline), that's that the ^ is for.

Looking at your log examples they all begin with a date/time, this is removed by fail2ban before the regex is applied to the rest of the line. The line doesn't begin with anything that '^' would recognse so that's why your regex is failing.

A simple example using your errorlog entry. If you want to take action for scriptunknown errors (that may or may not be a good thing) you could use a failregex like

failregex= scriptunknown", clinet: <HOST>

You can test this by running it past your log file using fail2ban-regex(1) e.g.

fail2ban-regex /path/to/logfile 'scriptunknown", client: <HOST>'
Running tests
=============

Use   failregex line : scriptunknown", client: <HOST>
Use         log file : /path/to/logfile
Use         encoding : UTF-8


Results
=======

Failregex: 1 total
|-  #) [# of hits] regular expression
|   1) [1] scriptunknown", client: <HOST>
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [1] Day(?P<_sep>[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
|  [1] Year(?P<_sep>[-/.])Month(?P=_sep)Day 24hour:Minute:Second(?:,Microseconds)?
`-

Lines: 2 lines, 0 ignored, 1 matched, 1 missed [processed in 0.00 sec]    
|- Missed line(s):
|  [01/Oct/2015:09:15:52 +0800] - 60.18.17.206, 113.21.15.23  "POST/httprl_async_function_callback?count=121 HTTP/1.1" 200 1351 "-" "Drupal (+http://drupal.org/)" "-"

Ok so that may do what you want but it may be too broad, you'd have to look at the results and make those calls.

by the way i dont use iptables software on my server (do i need to install one in order for fail2ban to work?)

You need some sort of firewall that is compatible with fail2ban installed and working on your system. As you tested it and

i manually baned my own IP and it works

Then I guess there is something there doing the job.

You must log in to answer this question.