0

Based on this repository I want to use fail2ban filters to analyze my nginx logs and ban suspicious requests and IPs.

On my server I'm using a custom log format for nginx. Due to the fact that I'm hosting multiple sites the log files have the following structure.

log_format custom_format '$server_name $remote_addr - $remote_user [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" "$http_user_agent" "$gzip_ratio"'

What will generate a log entry like this:

www.example.com 62.210.129.246 - - [24/Aug/2018:11:07:46 +0200] "POST /wp-login.php HTTP/1.1" 301 185 "http://example.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36" "-"

Due to the fact, that I'm adding the server_name in front of remote_addr the <HOST> regex-group (fail2ban resolves this to (?:::f{4,6}:)?(?P<host>\S+)) wont match. Not sure how I should modify the regex to match my log format.

Any ideas?

Improve this question

1 Answer 1

Reset to default
-1

Honestly don't waste your CPU on it, the "WebExploits" are really just background noise. Using fail2ban to reduce weblogs isn't actually providing a security benefit.

If you really must, put $server_name after the $remote_addr - in the nginx log format which matches the (not) WebExploits notion of regexes.

Alternately replace ^<HOST> in your regex with ^[^ ]* <HOST>. This means match non-space characters, followed by a space, followed by <HOST>

Improve this answer
3
  • Thanks for the answer! What else would you suggest to block "unwanted" visitors?
    – crebuh
    Aug 27, 2018 at 6:04
  • not looking or caring. Configuring nginx to not log certain locations and would be the best option if you can't resist looking.
    – danblack
    Aug 27, 2018 at 8:41
  • disabling logs also has the added advantage that it saves CPU and disk IO that can better used for your wanted visitors. It was the insistence by users to filter out things they didn't want to see that made me walk away from fail2ban development many years ago.
    – danblack
    Sep 15, 2018 at 11:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .