I've been trying to troubleshoot some issues with fail2ban and haven't been able to find any solutions that satisfy the issue. I have enabled the bad-bots filter for nginx and that is working fine. I can verify that fail2ban is updating the iptables: iptables_screenshot.
But when I look at the access logs for nginx(log_screenshot), it appears: 1.) that the bots are circumventing the rules and 2.) the bantime of 3600 seconds is also not working.
Am I failing to understand something about the way fail2ban is working here? Let me know if there is more that is needed to troubleshoot this....
here is a sample of the logs:
80.87.205.102 - - [03/Aug/2016:11:38:05 -0400] "POST /app/locale/zh/CN/template/option.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:11:38:05 -0400] "POST /dir.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:11:38:05 -0400] "POST /downloader/Maged/Connect/plugin.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:11:38:05 -0400] "POST /downloader/Maged/Exception.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:11:38:05 -0400] "POST /downloader/Maged/Model.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:11:38:05 -0400] "POST /downloader/Maged/Model/Config/template.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:11:38:06 -0400] "POST /downloader/Maged/Model/Connect.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:11:38:51 -0400] "POST /app/locale/ru/RU/user.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:11:38:51 -0400] "POST /app/locale/zh/CN/template/option.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:11:38:51 -0400] "POST /dir.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:11:38:52 -0400] "POST /downloader/Maged/Connect/plugin.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:11:38:52 -0400] "POST /downloader/Maged/Exception.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:11:38:52 -0400] "POST /downloader/Maged/Model.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:11:38:52 -0400] "POST /downloader/Maged/Model/Config/template.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:11:38:52 -0400] "POST /downloader/Maged/Model/Connect.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:12:13:34 -0400] "POST /app/locale/ru/RU/user.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:12:13:34 -0400] "POST /app/locale/zh/CN/template/option.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:12:13:34 -0400] "POST /dir.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:12:13:35 -0400] "POST /downloader/Maged/Connect/plugin.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:12:13:35 -0400] "POST /downloader/Maged/Exception.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:12:13:35 -0400] "POST /downloader/Maged/Model.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:12:13:35 -0400] "POST /downloader/Maged/Model/Config/template.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:12:13:35 -0400] "POST /downloader/Maged/Model/Connect.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:12:26:15 -0400] "POST /app/locale/ru/RU/user.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:12:26:15 -0400] "POST /app/locale/zh/CN/template/option.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:12:26:15 -0400] "POST /dir.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:12:26:16 -0400] "POST /downloader/Maged/Connect/plugin.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:12:26:16 -0400] "POST /downloader/Maged/Exception.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:12:26:16 -0400] "POST /downloader/Maged/Model.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:12:26:16 -0400] "POST /downloader/Maged/Model/Config/template.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
80.87.205.102 - - [03/Aug/2016:12:26:16 -0400] "POST /downloader/Maged/Model/Connect.php HTTP/1.1" 404 200 "google.com" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)"
and the fail2ban.log:
2016-08-03 11:36:42,796 fail2ban.actions[5191]: WARNING [nginx-badbots] Ban 80.87.205.110
2016-08-03 11:36:43,804 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.110 already banned
2016-08-03 11:36:44,806 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.110 already banned
2016-08-03 11:36:45,807 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.110 already banned
2016-08-03 11:38:05,903 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.102 already banned
2016-08-03 11:38:06,904 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.102 already banned
2016-08-03 11:38:07,906 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.102 already banned
2016-08-03 11:38:08,907 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.102 already banned
2016-08-03 11:38:51,939 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.102 already banned
2016-08-03 11:38:52,940 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.102 already banned
2016-08-03 11:38:53,941 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.102 already banned
2016-08-03 11:38:54,942 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.102 already banned
2016-08-03 11:54:27,001 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.110 already banned
2016-08-03 11:54:28,002 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.110 already banned
2016-08-03 11:54:29,004 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.110 already banned
2016-08-03 11:54:30,005 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.110 already banned
2016-08-03 12:07:21,781 fail2ban.actions[5191]: WARNING [nginx-badbots] Ban 162.210.196.98
2016-08-03 12:13:35,224 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.102 already banned
2016-08-03 12:13:36,226 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.102 already banned
2016-08-03 12:13:37,227 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.102 already banned
2016-08-03 12:13:38,229 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.102 already banned
2016-08-03 12:22:38,876 fail2ban.actions[5191]: WARNING [nginx-badbots] Unban 80.87.205.102
2016-08-03 12:25:56,126 fail2ban.actions[5191]: WARNING [nginx-badbots] Unban 199.58.86.211
2016-08-03 12:26:16,156 fail2ban.actions[5191]: WARNING [nginx-badbots] Ban 80.87.205.102
2016-08-03 12:26:16,162 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.102 already banned
2016-08-03 12:26:17,162 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.102 already banned
2016-08-03 12:26:18,164 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.102 already banned
2016-08-03 12:26:19,165 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.110 already banned
2016-08-03 12:26:20,167 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.110 already banned
2016-08-03 12:26:21,168 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.110 already banned
2016-08-03 12:26:22,170 fail2ban.actions[5191]: WARNING [nginx-badbots] Ban 80.87.205.101
2016-08-03 12:26:22,177 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.110 already banned
2016-08-03 12:26:23,179 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.101 already banned
2016-08-03 12:26:24,180 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.101 already banned
2016-08-03 12:26:25,182 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.101 already banned
2016-08-03 12:32:06,598 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.110 already banned
2016-08-03 12:32:07,600 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.110 already banned
2016-08-03 12:32:08,602 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.110 already banned
2016-08-03 12:32:09,603 fail2ban.actions[5191]: INFO [nginx-badbots] 80.87.205.110 already banned
iptables (this was current as of today, but the rules are in the same order):
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
1097K 433M fail2ban-nginx-badbots all -- any any anywhere anywhere
1095K 433M fail2ban-nginx-noproxy all -- any any anywhere anywhere
1092K 433M fail2ban-nginx-http-auth all -- any any anywhere anywhere
1092K 433M fail2ban-ssh all -- any any anywhere anywhere
4050 429K ACCEPT all -- lo any anywhere anywhere
0 0 REJECT all -- !lo any loopback/8 anywhere reject-with icmp-port-unreachable
15 616 ACCEPT icmp -- any any anywhere anywhere state NEW icmp echo-request
1545 92188 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh state NEW
14599 766K ACCEPT tcp -- any any anywhere anywhere tcp dpt:http state NEW
27390 1517K ACCEPT tcp -- any any anywhere anywhere tcp dpt:https state NEW
1093K 450M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
2679 183K LOG all -- any any anywhere anywhere limit: avg 5/min burst 5 LOG level debug prefix "iptables_INPUT_denied: "
3620 404K REJECT all -- any any anywhere anywhere reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 LOG all -- any any anywhere anywhere limit: avg 5/min burst 5 LOG level debug prefix "iptables_FORWARD_denied: "
0 0 REJECT all -- any any anywhere anywhere reject-with icmp-port-unreachable
Chain OUTPUT (policy ACCEPT 4214 packets, 2981K bytes)
pkts bytes target prot opt in out source destination
Chain fail2ban-nginx-badbots (1 references)
pkts bytes target prot opt in out source destination
0 0 REJECT all -- any any dslb-178-006-246-231.178.006.pools.vodafone-ip.de anywhere reject-with icmp-port-unreachable
32 1917 REJECT all -- any any 142.54.184.90 anywhere reject-with icmp-port-unreachable
24 7139 REJECT all -- any any 80.87.205.103 anywhere reject-with icmp-port-unreachable
0 0 REJECT all -- any any 80.87.205.101 anywhere reject-with icmp-port-unreachable
32 1920 REJECT all -- any any 80.87.205.110 anywhere reject-with icmp-port-unreachable
1095K 433M RETURN all -- any any anywhere anywhere
Chain fail2ban-nginx-http-auth (1 references)
pkts bytes target prot opt in out source destination
1092K 433M RETURN all -- any any anywhere anywhere
Chain fail2ban-nginx-noproxy (1 references)
pkts bytes target prot opt in out source destination
17 816 REJECT all -- any any 178-137-87-60-broadband.kyivstar.net anywhere reject-with icmp-port-unreachable
1092K 433M RETURN all -- any any anywhere anywhere
Chain fail2ban-ssh (1 references)
pkts bytes target prot opt in out source destination
1091K 433M RETURN all -- any any anywhere anywhere
and then the jail.local file for fail2ban:
# Fail2Ban configuration file.
#
# This file was composed for Debian systems from the original one
# provided now under /usr/share/doc/fail2ban/examples/jail.conf
# for additional examples.
#
# Comments: use '#' for comment lines and ';' for inline comments
#
# To avoid merges during upgrades DO NOT MODIFY THIS FILE
# and rather provide your changes in /etc/fail2ban/jail.local
#
# The DEFAULT allows a global definition of the options. They can be overridden
# in each jail afterwards.
[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1/8 ;naturally my ip address goes here, just omitting here
# External command that will take an tagged arguments to ignore, e.g. ,
# and return true if the IP is to be ignored. False otherwise.
#
# ignorecommand = /path/to/command
ignorecommand =
# "bantime" is the number of seconds that a host is banned.
bantime = 3600
# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 360
maxretry = 3
# "backend" specifies the backend used to get files modification.
# Available options are "pyinotify", "gamin", "polling" and "auto".
# This option can be overridden in each jail as well.
#
# pyinotify: requires pyinotify (a file alteration monitor) to be installed.
# If pyinotify is not installed, Fail2ban will use auto.
# gamin: requires Gamin (a file alteration monitor) to be installed.
# If Gamin is not installed, Fail2ban will use auto.
# polling: uses a polling algorithm which does not require external libraries.
# auto: will try to use the following backends, in order:
# pyinotify, gamin, polling.
backend = auto
# "usedns" specifies if jails should trust hostnames in logs,
# warn when reverse DNS lookups are performed, or ignore all hostnames in logs
#
# yes: if a hostname is encountered, a reverse DNS lookup will be performed.
# warn: if a hostname is encountered, a reverse DNS lookup will be performed,
# but it will be logged as a warning.
# no: if a hostname is encountered, will not be used for banning,
# but it will be logged as info.
usedns = warn
#
# Destination email address used solely for the interpolations in
# jail.{conf,local} configuration files.
destemail = kevin@rocky
#
# Name of the sender for mta actions
sendername = Fail2Ban
# Email address of the sender
sender = fail2ban@localhost
#
# ACTIONS
#
# Default banning action (e.g. iptables, iptables-new,
# iptables-multiport, shorewall, etc) It is used to define
# action_* variables. Can be overridden globally or per
# section within jail.local file
banaction = iptables-allports
# email action. Since 0.8.1 upstream fail2ban uses sendmail
# MTA for the mailing. Change mta configuration parameter to mail
# if you want to revert to conventional 'mail'.
mta = sendmail
# Default protocol
protocol = all
# Specify chain where jumps would need to be added in iptables-* actions
chain = INPUT
#
# Action shortcuts. To be used to define action parameter
# The simplest action to take: ban only
action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
# ban & send an e-mail with whois report to the destemail.
action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
%(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s", sendername="%(sendername)s"]
# ban & send an e-mail with whois report and relevant log lines
# to the destemail.
action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
%(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s", sendername="%(sendername)s"]
# Choose default action. To change, just override value of 'action' with the
# interpolation to the chosen action shortcut (e.g. action_mw, action_mwl, etc) in jail.local
# globally (section [DEFAULT]) or per specific section
action = %(action_)s
#
# JAILS
#
####
# other jails present
# just putting the relevant ones here
####
[nginx-http-auth]
enabled = true
filter = nginx-http-auth
port = http,https
logpath = /var/log/nginx/error.log
[nginx-noproxy]
enabled = true
port = http,https
filter = nginx-noproxy
logpath = /var/log/nginx/access.log
maxretry = 2
[nginx-badbots]
enabled = true
port = http,https
filter = nginx-badbots
logpath = /var/log/nginx/access.log
maxretry = 2
-v) and the relevant parts of the fail2ban configuration.