1

I am trying to figure out how to create a failregex filter for fail2ban to safeguard against the attacks below. I tried the following failregex expressions but they are not matching anything from the /var/log/https/error_log

failregex = ^\[[^\]]+\] \[error\] \[client <HOST>\].*File does not exist: .*pma* *\s*$

OR

failregex = ^[[^\]]+\] \[error\] \[client <HOST>\] File does not exist: *phpyadmin* *\s*$

Here are the probes that I am trying to create rules for

[Sat Aug 05 15:42:46 2017] [error] [client 109.188.133.141] File does not exist: /var/www/vhosts/default/htdocs/phpmyadmin2015
[Sat Aug 05 15:42:46 2017] [error] [client 109.188.133.141] File does not exist: /var/www/vhosts/default/htdocs/phpmyadmin2016
[Sat Aug 05 15:42:47 2017] [error] [client 109.188.133.141] File does not exist: /var/www/vhosts/default/htdocs/phpmyadmin2017
[Sat Aug 05 15:42:48 2017] [error] [client 109.188.133.141] File does not exist: /var/www/vhosts/default/htdocs/PMA2014
[Sat Aug 05 15:42:49 2017] [error] [client 109.188.133.141] File does not exist: /var/www/vhosts/default/htdocs/PMA2015
[Sat Aug 05 15:42:49 2017] [error] [client 109.188.133.141] File does not exist: /var/www/vhosts/default/htdocs/PMA2016
[Sat Aug 05 15:42:49 2017] [error] [client 109.188.133.141] File does not exist: /var/www/vhosts/default/htdocs/PMA2017
[Sat Aug 05 15:42:50 2017] [error] [client 109.188.133.141] File does not exist: /var/www/vhosts/default/htdocs/PMA2018
[Sat Aug 05 15:42:52 2017] [error] [client 109.188.133.141] File does not exist: /var/www/vhosts/default/htdocs/pma2015
[Sat Aug 05 15:42:52 2017] [error] [client 109.188.133.141] File does not exist: /var/www/vhosts/default/htdocs/pma2016
[Sat Aug 05 15:42:52 2017] [error] [client 109.188.133.141] File does not exist: /var/www/vhosts/default/htdocs/pma2017
[Sat Aug 05 15:42:53 2017] [error] [client 109.188.133.141] File does not exist: /var/www/vhosts/default/htdocs/pma2018

The regex expressions are not correctly recognizing the format in which the logs are being created. Any help would be greatly appreciated. I just need one wild card rule that scans for a) File does not exist and b) any of the following strings on that error line pma*, php*

1

Thank you for the suggestions above, but after countless tries here are the expressions that worked.

[Definition]
ignoreregex = 
failregex = \[client <HOST>\] File does not exist:.*(?i)MyAdmin.*
\[client <HOST>\] File does not exist:.*(?i)mysqlmanager.*
\[client <HOST>\] File does not exist:.*(?i)PMA.*
\[client <HOST>\] File does not exist:.*(?i)pma.*   
\[client <HOST>\] File does not exist:.*(?i)php-my-admin.*  
\[client <HOST>\] File does not exist:.*(?i)myadmin.*   
\[client <HOST>\] File does not exist:.*(?i)administrator.*     
\[client <HOST>\] File does not exist:.*(?i)xmlrpc.*            
\[client <HOST>\] File does not exist:.*(?i)testproxy.* 
\[client <HOST>\] File does not exist:.*(?i)phpMyAdmin.*
\[client <HOST>\] File does not exist:.*(?i)db.*    
\[client <HOST>\] File does not exist:.*(?i)sql.*       

If someone has plesk on centos, they can use these rules to thwart attacks. My server kept having the apache process run at 100% cpu usage.

0

The most obvious error I can see is here -

pma* *\s*$

That's matching pm, following by a zero or more times. Then after that it's matching a space zero or more times, followed by \s (space or tab) zero or more times.

So basically it has to end with pma followed by zero or more spaces. Same with the other regex.

You should try something like pma.*\s* (assuming you need to account for possible spaces at the end of the line.

Edit - The full expression should be something like the following, although obviously I can't really test it.

\[client <HOST>\] File does not exist: .+pma
  • What would the whole failregex rule be – Ryan A Aug 5 '17 at 22:03
  • ^[[^]]+] [error] [client <HOST>] File does not exist: .+pma.+$ is not matching anything after I do fail2ban-regex. Outputs Lines: 26778 lines, 0 ignored, 0 matched, 26778 missed – Ryan A Aug 5 '17 at 22:14
  • According to fail2ban.org/wiki/index.php/MANUAL_0_8 fail2ban matches the timestamp itself, so the regex should exclude that. I've updated the answer although as I can't really test fail2ban myself it may require minor adjustments – USD Matt Aug 5 '17 at 22:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.