0

So i am newbie about all this. This is how log looks:

213.135.179.254 - - [27/Apr/2017:17:39:06 +0200] "GET /get.php?username=1515&password=1515&type=m3u HTTP/1.1" 200 0 "-" "-"
213.135.179.254 - - [27/Apr/2017:17:39:06 +0200] "GET /get.php?username=1859&password=1859&type=m3u HTTP/1.1" 200 0 "-" "-"
213.135.179.254 - - [27/Apr/2017:17:39:07 +0200] "GET /get.php?username=1877&password=1877&type=m3u HTTP/1.1" 200 0 "-" "-"

So i need custom filter and everything else. I want to to ban every ip that sends more than 10 requests like that. Well, trick is that when they send requests like this, its wrong url, i mean, they dont get anything. When ip sends correct get.php requests, they get downloadable m3u file, so i think its status code 302? So i want to ban ip that sends more than 10 wrong get.php requests, with status code 200. please help

EDIT: This is how it looks when get.php requests is valid:

185.24.35.240 - - [30/Apr/2017:15:14:27 +0200] "GET /get.php?username=bracelo@apan-135d&password=4sfZ8va5OS&type=m3u&output=mpegts HTTP/1.1" 200 93528 "-" "VLC/2.2.4 LibVLC/2.2.4"
185.24.35.240 - - [30/Apr/2017:15:14:37 +0200] "GET /get.php?username=tester2ip@262sdf&password=D86Td3v3TP&type=m3u&output=mpegts HTTP/1.1" 200 92588 "-" "VLC/2.2.4 LibVLC/2.2.4"
Improve this question
2
  • Beware that if you set this custom filter, you will block all clients with this IP that goes to any site on the server, legitimate or by your judge illegitimate, indiscriminately.
    – Miloš Đakonović
    Apr 30, 2017 at 10:41
  • Ok, i want to do that. When someone is sending too many requests, i want to ban him permanently. And i want to ip dont have any access anymore.
    – Milos
    Apr 30, 2017 at 13:25

1 Answer 1

Reset to default
1

Http 200 is a successful http code...

Some basic information for you: https://en.m.wikipedia.org/wiki/List_of_HTTP_status_codes

If you really do want to ban these... (not recommended) then just set up a fail2ban filter for this... Change the return status to 403 and then setup fail2ban with this. 

[Definition]
failregex = <HOST>.*GET.*(get\.php).* 403
Improve this answer
9
  • 2
    I'd first edit get.php to send 403 on login failure and then write the fail2ban filter. Otherwise it would also ban after 10 successful downloads.
    – Esa Jokinen
    Apr 30, 2017 at 10:25
  • Well, yes it successfull HTTP code. I mean its not succesfull because they are not getting m3u file. This get.php links are like download links, when they make it right, they got .m3u file, when they make it wrong, they got nothing, blank page, code 200. And thats the problem, i dont know how to create custom filter. And why is this not recommended? I need to ban them because they are overwhelming my CPU with so much requests. They are scanning for valid user name and pass through get.php requests. And i want to protect my server by banning them. I need custom filter. Please help
    – Milos
    Apr 30, 2017 at 13:06
  • 1
    As Joniken said, you need to edit the 200 to be 403. You can edit this in the get.php file. Once you've done this you can use a regex like the one I edited above.
    – NotoriousPyro
    Apr 30, 2017 at 19:58
  • Ok, i understand. But if i cant edit get.php file? There is no other way?
    – Milos
    May 1, 2017 at 13:13
  • Problem is that get.php is encoded with Zend Guard. I will see if i can do something with that, to decode it and change code. If not, can i ban every ip that sends more than 3 get.php requests in 5 seconds? How would filter look then? Any get.php requests, never mind valid or not.
    – Milos
    May 1, 2017 at 13:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .