0

So i am trying to rate limit POST requests on my server. I have looked around and tried every permutation of strings that i can find on the internet.

this is my jail.local apache conf

[apache-postUsHttp]

enabled = true
port = http,https
filter = apache-postflood
logpath = /var/log/apache2/other_vhosts_access.log
findtime = 30
bantime = 3600
maxretry = 10

and here you have the apache-postflood.conf filter

# Fail2Ban configuration file
#
#
# $Revision: 1 $
#

[Definition]
# Option: failregex
# Notes.: Regexp to catch known spambots and software alike. Please verify
# that it is your intent to block IPs which were driven by
# abovementioned bots.
# Values: TEXT
#
failregex = ^<HOST>.*"POST.*

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

here is an example access post log.

my.tld:80 x.x.x.x - - [25/Aug/2016:05:53:52 -0400] "POST /location/of/file.php HTTP/1.1" 302 300 "http://my.tld/" "Mozilla/5.0 (iPhone; CPU iPhone OS 9_3_4 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Version/9.0 Mobile/13G35 Safari/601.1"

i ahve also tried the following failregex = ^ -.* "POST.*

and a lot of other slight variations. but no matter what i do i get no filter notices / infos in my fail2ban logs.

i know that the timespamps are parsing and that it is reading the log, because when i turn on debug loggin it is definately loggin it all.

0

Your regex is wrong. You are attempting to match <HOST> at the beginning of the line ^<HOST> and the one you want is not there it is after the my.tld:80:.

Something like

'^.*:80 <HOST> - - .*"POST.*'

may work for you but you may have to tune it. Don't forget there is fail2ban-regex(1) which is handy for testing.

| improve this answer | |
  • yeah i figured that out. I decided to pull out the logging for this specific site, their are a few sites on the server and they were all logging to the same file. – Evil Eeyore Aug 25 '16 at 11:34
0

So i figured it out.

the problem was in the shared access log.

I was usuing one access log for multiple sites on this server, and the log was trying to use the first host, being the name of the website and trying to lookup dns to ban it.

IE

my.tld:80 x.x.x.x ......

the x.x.x.x was the ip that i needed to be regexing. if anyone could tell me the proper regex for this that would be great, but simply making my own log files for this sites solved the issue.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.