0

I need to limit POST requests with Fail2ban for this type of log:

"POST /subscribers"

But not block the requests that are:

"POST /subscribers/*" i.e. "POST /subscribers/18"

Is it possible to do with fail2ban? So far I've tried the following jail "subscribers.conf":

[Definition]
failregex = ^<HOST> -.*POST /subscribers
ignoreregex = ^<HOST> -.*POST /subscribers/*

But due to the ignoreregex, other requests also being ignored. Any help appreciated!

Jail.local file:

[DEFAULT]
ignoreip = 127.0.0.1/8
mta = mail
destemail = root
sendername = Fail2BanAlerts
findtime = 3600
bantime = 6000
#Send mail on all jails: action = %(action_mwl)s

[subscribers]
enabled  = true
port     = http,https
filter   = subscribers
logpath  = /var/log/nginx/access.log
maxretry = 3
  • Are the quotation marks supposed to be there? You have them in failregex but not ignoreregex. – mzhaase May 2 '17 at 11:29
  • Hey @mzhaase, nope, I was just trying different options and forgot to remove. – Ilya May 2 '17 at 11:34
  • Try failregex = ^<HOST> -.*POST /subscribers$ – mzhaase May 2 '17 at 11:40
  • Thanks @mzhaase but unfortunately it doesn't work. It still allows the POST /subscribers – Ilya May 2 '17 at 11:49
  • Can you post your complete fail2ban configuration, as it pertains to this jail? – mzhaase May 2 '17 at 11:52
0

/ needs to be escaped in regex.

ignoreregex = ^<HOST> -.*POST \/subscribers\/.+ 
failregex = ^<HOST> -.*POST \/subscribers\s.+

Will work. What might have happend here is that the regex just ended at the first /. I always use one of the many free online regex checkers against the string I am trying to parse.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.