0

I want to use fail2ban for protecting my server. The http server is a script node that I succeded at formatting the logs like following:

2017-03-18 18:03:32.940 [ INFO ] - ::ffff:192.168.1.56 GET /

The interesting part of jail.conf is:

[node-get-dos]
enabled = true
port = 8080 
filter = node-get-dos
logpath = /logs/selector.log
maxretry = 10
findtime = 10
bantime = 600

and the content of node-get-dos is:

[Definition]
failregex = \[.*\].*:.?:.*:<HOST>.*\ (GET|POST|DELETE).*
ignoreregex =

So when I launch the following command, I don't get banned:

ab -n 1000 -c 100 http://192.168.1.3:8080/

And I Don't know if it's important, but the node script is in a docker container.

I've already a solution which is to put the node behind a reverse proxy (apache) and to configure fail2ban to analyse the logs of apache (access.log) but I want to avoid that (consumes more cpu and RAM).

EDIT: Here's an example after a reboot and launching the ab command:

2017-03-18 19:25:52,296 fail2ban.server         [15690]: INFO    Exiting Fail2ban
2017-03-18 19:25:52,584 fail2ban.server         [21170]: INFO    Changed logging target to /var/log/fail2ban.log for Fail2ban v0.9.3
2017-03-18 19:25:52,586 fail2ban.database       [21170]: INFO    Connected to fail2ban persistent database '/var/lib/fail2ban/fail2ban.sqlite3'
2017-03-18 19:25:52,591 fail2ban.jail           [21170]: INFO    Creating new jail 'sshd'
2017-03-18 19:25:52,606 fail2ban.jail           [21170]: INFO    Jail 'sshd' uses pyinotify
2017-03-18 19:25:52,617 fail2ban.filter         [21170]: INFO    Set jail log file encoding to UTF-8
2017-03-18 19:25:52,622 fail2ban.jail           [21170]: INFO    Initiated 'pyinotify' backend
2017-03-18 19:25:52,626 fail2ban.filter         [21170]: INFO    Set maxRetry = 3
2017-03-18 19:25:52,627 fail2ban.actions        [21170]: INFO    Set banTime = 900
2017-03-18 19:25:52,630 fail2ban.filter         [21170]: INFO    Added logfile = /var/log/auth.log
2017-03-18 19:25:52,633 fail2ban.filter         [21170]: INFO    Set findtime = 600
2017-03-18 19:25:52,633 fail2ban.filter         [21170]: INFO    Set jail log file encoding to UTF-8
2017-03-18 19:25:52,634 fail2ban.filter         [21170]: INFO    Set maxlines = 10
2017-03-18 19:25:52,691 fail2ban.server         [21170]: INFO    Jail sshd is not a JournalFilter instance
2017-03-18 19:25:52,695 fail2ban.jail           [21170]: INFO    Creating new jail 'node-get-dos'
2017-03-18 19:25:52,695 fail2ban.jail           [21170]: INFO    Jail 'node-get-dos' uses pyinotify
2017-03-18 19:25:52,696 fail2ban.filter         [21170]: INFO    Set jail log file encoding to UTF-8
2017-03-18 19:25:52,699 fail2ban.jail           [21170]: INFO    Initiated 'pyinotify' backend
2017-03-18 19:25:52,703 fail2ban.filter         [21170]: INFO    Set maxRetry = 10
2017-03-18 19:25:52,703 fail2ban.actions        [21170]: INFO    Set banTime = 600
2017-03-18 19:25:52,706 fail2ban.filter         [21170]: INFO    Added logfile = /logs/selector.log
2017-03-18 19:25:52,710 fail2ban.filter         [21170]: INFO    Set findtime = 10
2017-03-18 19:25:52,710 fail2ban.filter         [21170]: INFO    Set jail log file encoding to UTF-8
2017-03-18 19:25:52,718 fail2ban.jail           [21170]: INFO    Jail 'sshd' started
2017-03-18 19:25:52,724 fail2ban.jail           [21170]: INFO    Jail 'node-get-dos' started
0

The fail2ban-regex utility says that your regex is good and it matches the log you have provided

Lines: 1 lines, 0 ignored, 1 matched, 0 missed

so you need to look elsewhere. You should check the fail2ban log messages from fail2ban's startup, to ensure that for example it can read the log file. I have no idea where you'll find them in the frankenstack you have.

  • I've updated my post with the /var/log/fail2ban.log – rsabir Mar 18 '17 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.