0

I'm trying to add two fail2ban filters, one for post flood and phpmyadmin brute force but i get the following errors.

logs:

fail2ban.filter : ERROR  No 'host' group in '[[]client []] File does not exist: /var/www/(?:PMA|phpmyadmin|myadmin|mysql|mysqladmin|sqladmin|mypma|admin|xampp|mysqldb|mydb|db|pmadb|phpmyadmin1|phpmyadmin2)'

fail2ban.filter : ERROR  No 'host' group in '^ -.*”POST.*'

jail.conf:

[apache-phpmyadmin]
enabled  = true
port     = http,https
filter   = apache-phpmyadmin
logpath  = /var/log/apache*/*error.log
maxretry = 3

[apache-postflood]
enabled = true
port = http,https
filter = apache-postflood
logpath = /var/log/apache*/*flood.log
findtime = 10
maxretry = 10

apache-phpmyadmin.conf filter:

[Definition] 
docroot = /var/www
badadmin = PMA|phpmyadmin|myadmin|mysql|mysqladmin|sqladmin|mypma|admin|xampp|mysqldb|mydb|db|pmadb|phpmyadmin1|phpmyadmin2
failregex = [[]client []] File does not exist: %(docroot)s/(?:%(badadmin)s)
ignoreregex =

apache-postflood.conf filter:

[Definition]
failregex = ^ -.*”POST.*
ignoreregex =
4

Your failregex is missing the special string <HOST> which you must insert in the place where the IP address will appear in the log entry. This is required so that fail2ban will know what IP address it should act on.

  • How to add the host in failregex? I'm not good with regex :( – RoastedCode May 9 '15 at 16:31
  • 2
    And that's the problem with blindly copying things off the Internet. In this case the tutorial you read has a blatant error in it. The correct line is: failregex = ^<HOST> -.*"POST.* If you view source of that page, you will see it's actually there but it wasn't properly HTML escaped. And the smart quote doesn't help either and would also cause it to fail to match. – Michael Hampton May 9 '15 at 16:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.