2

I'm trying to get fail2ban to block certain bad bots from hammering my website. I started off with just enabling the default "apache-badbots" in jail.local (I did change the logpath to match my own logs and the user it sends reports to)

enabled = true filter = apache-badbots action = iptables-multiport[name=BadBots, port="http,https"] sendmail-buffered[name=BadBots, lines=5, dest=jisti] logpath = /var/logs/httpd/access_log bantime = 172800 maxretry = 1

I restarted fail2ban and got an email saying the jail started. However as I was watching the logs one of the bad bots hammered the site and fail2ban did nothing.

So I checked out the apache-badbots.conf in filters. I came to the conclusion the regex probably wasn't matching the custom log format I was using, nor was it actually looking for the specific bad bot that was hammering my site. I tinkered with failregex and then tested with

fail2ban-regex /var/log/httpd/access_log /etc/fail2ban/filter.d/apache-badbots.conf

This reported success and over 300 matched. Woohoo I thought. I restarted fail2ban. Shortly thereafter I saw the bot hammering the site again and fail2ban doing nothing. I checked iptables just to see if it was doing something but getting the iptables rule wrong

iptables -S -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N fail2ban-BadBots -N fail2ban-SSH -N fail2ban-php-url-open -A INPUT -p tcp -m tcp --dport 22 -j fail2ban-SSH -A fail2ban-BadBots -j RETURN -A fail2ban-SSH -j RETURN -A fail2ban-php-url-open -j RETURN

Also I should mention when it blocks SSH attacks, it does correctly add iptables rules. So something does work just not apache-badbots.

I next tried to set fail2ban's logging to debug and read through fail2ban.log. Unfortunately there was nothing in there that helped. There were log entries for the jail starting and defining the correct regex as well as defining the actions. However there were no log entries for the apache-badbots jail matching and taking action against any IP.

Also I'll mention that the SSH jail seems to work just fine, so fail2ban does work on the box, just not the apache-badbots jail.

What do I need to do to get it to work?

2

In your jail.local, you direct fail2ban to /var/logs/httpd/access_log in stead of /var/log/httpd/access_log like in your regex test.

  • Oh wow thanks. I don't think I'd ever have noticed that. – Jistanidiot May 2 '16 at 13:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.