After noticing repeated attempts to access supposed webadmin resources on my server in blocks by the same ips (i.e. repeated attempts from each ip in a long list of 'common' server webadmin resources, e.g. /phpmyadmin, /mysql, etc.), I've set up a custom fail2ban filter (and jail) which tested successfully in fail2ban-regex against my apache2/access.log, showing 55 'hits' (seems about right without checking):

[INCLUDES] before = apache-common.conf [Definition] failregex = '^<HOST> - - .*"GET \/phpmyadmin|"GET \/phpMyAdmin|"GET \/pma\/|"GET \/myadmin|"GET \/admin|"GET \/mysql.*$' ignoreregex = ''

The fail2ban.log shows the new jail loaded. However, none of several offending ips in the current apache2/access.log is listed in the fail2ban.log after restart.

My understanding of f2b is that it bans against current logs without waiting for new log entries.

Does this indicate the new filter and jail aren't working as intended?



As I understand, fail2ban ignores any log entries which are older than findtime setting for a jail (default is 600 seconds).

| improve this answer | |
  • Yeah, the new filter/jail appears to be working (banning) now, but throwing "No 'host' found" errors in the fail2ban.log. I removed the single quotes around my regex but this didn't help. – David Smith May 9 '18 at 15:02
  • Fixed the error by throwing parentheses around the boolean-delimited string. Seems to be all good now. – David Smith May 9 '18 at 16:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.