0

Which actions specifically are considered as violating apache noscript fail2ban module? I see that it correctly banned the ip that was looking for strange urls like "/admin" "/login" etc, but also blocked my ip and I checked the log for my ip and I didn't see any suspicious actions. So in one case it worked good in another it didn't.

Btw one of this line was considered as apache noscript violation. Why?

myip - - [05/Sep/2020:12:55:52 +0000] "GET /css/theme/jquery-ui.custom.css HTTP/1.1" 
myip - - [05/Sep/2020:12:55:52 +0000] "GET /img/icons/manifest.json HTTP/1.1" 
myip - - [05/Sep/2020:12:55:52 +0000] "GET /css/some.css HTTP/1.1" 
myip - - [05/Sep/2020:12:55:52 +0000] "GET /css/bootstrap.min.css HTTP/1.1" 
myip - - [05/Sep/2020:12:55:52 +0000] "GET /ww.js.map HTTP/1.1" 
myip - - [05/Sep/2020:12:55:52 +0000] "GET /ww.js.map HTTP/1.1" 

Btw, why are not attached the log files in the mail report? I edited in the fail2ban configuration the log to /access.log from /*access.log so hopefully it will help with this.

0

Aha so the answer was not in the apache access.log but in the error.log:

[php7:error] [pid 7287] [client MYIP:42910] script '/var/www/html/error.php' not found or unable to stat

and reason is that in htaccess i have set the 404 page as /error.php I guess and it then triggers the apache-noscript jail as stated in the configuration file of this jail which is located in /etc/fail2ban/filter.d/apache-noscript.conf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.