0

I need to limit POST requests with Fail2ban for this type of log:

"POST /subscribers"

But not block the requests that are:

"POST /subscribers/*" i.e. "POST /subscribers/18"

Is it possible to do with fail2ban? So far I've tried the following jail "subscribers.conf":

[Definition]
failregex = ^<HOST> -.*POST /subscribers
ignoreregex = ^<HOST> -.*POST /subscribers/*

But due to the ignoreregex, other requests also being ignored. Any help appreciated!

Jail.local file:

[DEFAULT]
ignoreip = 127.0.0.1/8
mta = mail
destemail = root
sendername = Fail2BanAlerts
findtime = 3600
bantime = 6000
#Send mail on all jails: action = %(action_mwl)s

[subscribers]
enabled  = true
port     = http,https
filter   = subscribers
logpath  = /var/log/nginx/access.log
maxretry = 3
8
  • Are the quotation marks supposed to be there? You have them in failregex but not ignoreregex.
    – mzhaase
    May 2, 2017 at 11:29
  • Hey @mzhaase, nope, I was just trying different options and forgot to remove.
    – Ilya
    May 2, 2017 at 11:34
  • Try failregex = ^<HOST> -.*POST /subscribers$
    – mzhaase
    May 2, 2017 at 11:40
  • Thanks @mzhaase but unfortunately it doesn't work. It still allows the POST /subscribers
    – Ilya
    May 2, 2017 at 11:49
  • Can you post your complete fail2ban configuration, as it pertains to this jail?
    – mzhaase
    May 2, 2017 at 11:52

1 Answer 1

0

/ needs to be escaped in regex.

ignoreregex = ^<HOST> -.*POST \/subscribers\/.+ 
failregex = ^<HOST> -.*POST \/subscribers\s.+

Will work. What might have happend here is that the regex just ended at the first /. I always use one of the many free online regex checkers against the string I am trying to parse.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .