2

I noticed a bunch of those w00tw00t requests coming to my Ubuntu 12.04 server and so I installed fail2ban. I followed these instructions on setting up Fail2ban against w00tw00t requests. I made sure to name the files properly, and restart fail2ban after the configuration was changed.

I tested by typing in various w00tw00t parameters in my URL just like the attackers do, but none would ban me. I did not add my IP to a list of ignore. I even tried from my phone, still no ban.

In jail.conf I have the following located in /etc/fail2ban/jail.conf

[w00tw00t-scans]

enabled  = true

action   = iptables-allports

sendmail-whois[name=SSH, dest=ubuntu, [email protected]]

filter   = w00tw00t

logpath  = /var/log/apache2/access.log

maxretry = 1

bantime  = 120  #testing so that I can verify and not be banned for a day!

Here is w00tw00t filter located in /etc/fail2ban/filter.d/w00tw00t.conf

#block w00tw00t scans of all variations

[Definition]

failregex = ^<HOST> .*”GET \/w00tw00t*

ignoreregex =

I verified that the log path is set correctly by typing in an obscure parameter in my URL, then checked access.log and sure enough it was there. I also made sure to restart fail2ban afterward I added the rules.

Is there any other setup I need to do out of the box with fail2ban? After I installed the only thing I did was add the filter and the wootwoot bit to jail.conf. I checked to make sure it's running by typing /etc/init.d/fail2ban start and it responds with * Socket file /var/run/fail2ban/fail2ban.sock is present

edit - just showing what the request looks like on /var/log/apache2/access.log

Here's a malicious request

67.215.248.8 - - [12/Feb/2014:18:59:42 +0000] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 1997 "-" "ZmEu"

And here's a request I made

My.IP.Address - - [12/Feb/2014:21:41:13 +0000] "GET /w00tw00t HTTP/1.1" 404 1928 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36"

1 Answer 1

3

Those quotes don't look right to me did you use a proper text editor to write your regex ? Try

Failregex = ^<HOST> .*"GET /w00tw00t.*"

Which according to fail2ban-regex finds the in both your examples.

7
  • Nope, just tried again with the new regex. Still not banned! Feb 12, 2014 at 21:39
  • @user1104854: Show us a line from the log you're scanning then
    – user9517
    Feb 12, 2014 at 21:40
  • I updated my post with a malicious request and one that I just made. Feb 12, 2014 at 21:44
  • @user1104854: updated my answer
    – user9517
    Feb 12, 2014 at 21:57
  • Is there an easy way to cover SSL with this too, or should I just make another rule and use ssl_access.log for that one? Feb 12, 2014 at 22:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .