0

I've added an xmlrpc jail for fail2ban to protect against a persistent attack. The apache access.log is as below...

191.96.249.80 - - [16/Dec/2016:14:54:21 +0000] "POST /xmlrpc.php HTTP/1.0" 403 469 "-" "Mozilla/4.0 (compatible: MSIE 7.0; Windows NT 6.0)"
191.96.249.80 - - [16/Dec/2016:14:54:21 +0000] "POST /xmlrpc.php HTTP/1.0" 403 469 "-" "Mozilla/4.0 (compatible: MSIE 7.0; Windows NT 6.0)"
191.96.249.80 - - [16/Dec/2016:14:54:21 +0000] "POST /xmlrpc.php HTTP/1.0" 403 469 "-" "Mozilla/4.0 (compatible: MSIE 7.0; Windows NT 6.0)"
191.96.249.80 - - [16/Dec/2016:14:54:22 +0000] "POST /xmlrpc.php HTTP/1.0" 403 469 "-" "Mozilla/4.0 (compatible: MSIE 7.0; Windows NT 6.0)"

and my fail to ban def is as below...

[Definition]
failregex = ^<HOST> .*POST .*xmlrpc\.php.*
ignoreregex =

This doesn't appear to be matching as nothing for xmlrpc appears in the fail2ban log but fail2ban does report that jail as being active.

My jail is setup like this in my jail.conf file

[xmlrpc]
enabled = true
filter = xmlrpc
action = iptables[name=xmlrpc, port=http, protocol=tcp]
logpath = /var/log/apache2/access.log
bantime = 43600
maxretry = 0

Anybody got any ideas why it might not be matching?

1

I figured this out in the end. It turns out I'd missed the port definition from the xmlrpc jail setup.

[xmlrpc]
enabled = true
filter = xmlrpc
port = http,https
action = iptables[name=xmlrpc, port=http, protocol=tcp]
logpath = /var/log/apache2/access.log
bantime = 43600
maxretry = 0

Now works perfectly

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.