I am trying to configure fail2ban for my server and have come across:
apache-overflows in the .config
What does it do/protect against?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
The /etc/fail2ban/filters.d/apache-overflows.conf file may help explain it more:
Notes.: Regexp to catch Apache overflow attempts.
The regex that is being a applied to the log can provide more detail:
failregex = [client ] (Invalid method in request|request failed: URI too long|erroneous characters after protocol string)
Certain types of attacks against Apache are done to try and overflow the memory buffer and cause it to crash, effectively creating a denial of service. This filter attempts to detect the attack before it completely overwhelms the web server and then will apply whatever action you specify.