0

like the topic states im trying to setup fail2ban for nginx but im having some problems. I want to watch the req_limit error in the nginx error.log and ban the ip on cloudflare via fail2ban, so no ddos traffic reaches my server anymore. the nginx part works flawlessly. fail2ban-regex testing also works. but in live mode fail2ban just does nothing. no ban, no log entry, nothing. i hope you guys can help me out and tell me what im doing wrong!?

operating system: ubuntu 14.04
fail2ban version: 0.9.7-1~nd14.04+1 (through neurodebian; already tried 8.11 standard too)
nginx version 1.4.6

sample nginx error log:

2018/08/28 12:25:51 [error] 7984#0: *4762 limiting requests, excess: 60.877 by zone "ddos", client: 178.26.182.x, server: website.com, request: "GET proxy.php?url=h**ps://img2.picload.org/image/dddrwcwr/xxx.png HTTP/1.1", host: "website.com", referrer: "h**ps://website.com/"
2018/08/28 12:25:51 [error] 7984#0: *4763 limiting requests, excess: 60.877 by zone "ddos", client: 178.26.182.x, server: website.com, request: "GET proxy.php?url=h**ps://img2.picload.org/image/dddrwcwa/xxx.png HTTP/1.1", host: "website.com", referrer: "h**ps://website.com/"
2018/08/28 12:25:51 [error] 7984#0: *4764 limiting requests, excess: 60.867 by zone "ddos", client: 178.26.182.x, server: website.com, request: "GET proxy.php?url=h**ps://i.imgur.com/xxx.png HTTP/1.1", host: "website.com", referrer: "h**ps://website.com/"
2018/08/28 12:25:51 [error] 7984#0: *4765 limiting requests, excess: 60.865 by zone "ddos", client: 178.26.182.x, server: website.com, request: "GET proxy.php?url=h**ps://i.imgur.com/xxx.png HTTP/1.1", host: "website.com", referrer: "h**ps://website.com/"
2018/08/28 12:25:51 [error] 7984#0: *4756 limiting requests, excess: 60.797 by zone "ddos", client: 178.26.182.x, server: website.com, request: "GET proxy.php?url=h**ps://image.ibb.co/gHRsbK/xxx.png HTTP/1.1", host: "website.com", referrer: "h**ps://website.com/"
2018/08/28 12:25:51 [error] 7984#0: *4766 limiting requests, excess: 60.784 by zone "ddos", client: 178.26.182.x, server: website.com, request: "GET proxy.php?url=h**ps://picload.org/image/dowiapwi/xxx.png HTTP/1.1", host: "website.com", referrer: "h**ps://website.com/"
2018/08/28 12:25:51 [error] 7984#0: *4767 limiting requests, excess: 60.744 by zone "ddos", client: 178.26.182.x, server: website.com, request: "GET proxy.php?url=h**ps://img3.picload.org/image/dlggrwpl/xxx.png HTTP/1.1", host: "website.com", referrer: "h**ps://website.com/"

test output: fail2ban-regex /var/log/nginx/error.log /etc/fail2ban/filter.d/nginx-req-limit.conf

Running tests
=============

Use   failregex filter file : nginx-req-limit, basedir: /etc/fail2ban
Use         log file : /var/log/nginx/error.log
Use         encoding : ANSI_X3.4-1968


Results
=======

Failregex: 96 total
|-  #) [# of hits] regular expression
|   1) [96] limiting requests, excess:.* by zone.*client: <HOST>
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [96] Year(?P<_sep>[-/.])Month(?P=_sep)Day 24hour:Minute:Second(?:,Microseconds)?
`-

Lines: 96 lines, 0 ignored, 96 matched, 0 missed
[processed in 0.04 sec]

test fail2ban-client status

Status
|- Number of jail:      2
`- Jail list:   nginx-req-limit, sshd

fail2ban log: tail -f /var/log/fail2ban.log

2018-08-28 11:49:15,714 fail2ban.jail           [5649]: INFO    Creating new jail 'nginx-req-limit'
2018-08-28 11:49:15,714 fail2ban.jail           [5649]: INFO    Jail 'nginx-req-limit' uses pyinotify {}
2018-08-28 11:49:15,721 fail2ban.jail           [5649]: INFO    Initiated 'pyinotify' backend
2018-08-28 11:49:15,733 fail2ban.filter         [5649]: INFO    Added logfile = /var/log/nginx/error.log
2018-08-28 11:49:15,734 fail2ban.filter         [5649]: INFO    Set maxRetry = 1
2018-08-28 11:49:15,735 fail2ban.filter         [5649]: INFO    Set jail log file encoding to ANSI_X3.4-1968
2018-08-28 11:49:15,736 fail2ban.actions        [5649]: INFO    Set banTime = 7200
2018-08-28 11:49:15,736 fail2ban.filter         [5649]: INFO    Set findtime = 600
2018-08-28 11:49:15,743 fail2ban.jail           [5649]: INFO    Jail 'sshd' started
2018-08-28 11:49:15,749 fail2ban.jail           [5649]: INFO    Jail 'nginx-req-limit' started

configuration jail.local:

[nginx-req-limit]
enabled = true
filter = nginx-req-limit
action = cloudflare
logpath = /var/log/nginx/error.log
findtime = 600
bantime = 7200
maxretry = 1

filter nginx-req-limit.conf

[Definition]
failregex = limiting requests, excess:.* by zone.*client: <HOST>
ignoreregex =

action cloudflare.conf

# Author: Mike Rushton
#
# IMPORTANT
#
# Please set jail.local's permission to 640 because it contains your CF API key.
#
# This action depends on curl.
# Referenced from http://www.normyee.net/blog/2012/02/02/adding-cloudflare-support-to-fail2ban by NORM YEE
#
# To get your CloudFlare API Key: https://www.cloudflare.com/a/account/my-account
#
# CloudFlare API error codes: https://www.cloudflare.com/docs/host-api.html#s4.2

[Definition]

# Option:  actionstart
# Notes.:  command executed once at the start of Fail2Ban.
# Values:  CMD
#
actionstart =

# Option:  actionstop
# Notes.:  command executed once at the end of Fail2Ban
# Values:  CMD
#
actionstop =

# Option:  actioncheck
# Notes.:  command executed once before each actionban command
# Values:  CMD
#
actioncheck =

# Option:  actionban
# Notes.:  command executed when banning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    <ip>  IP address
#          <failures>  number of failures
#          <time>  unix timestamp of the ban time
# Values:  CMD
#
actionban = curl -s -o /dev/null https://www.cloudflare.com/api_json.html -d 'a=ban' -d 'tkn=<cftoken>' -d 'email=<cfuser>' -d 'key=<ip>'

# Option:  actionunban
# Notes.:  command executed when unbanning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    <ip>  IP address
#          <failures>  number of failures
#          <time>  unix timestamp of the ban time
# Values:  CMD
#
actionunban = curl -s -o /dev/null https://www.cloudflare.com/api_json.html -d 'a=nul' -d 'tkn=<cftoken>' -d 'email=<cfuser>' -d 'key=<ip>'

[Init]

# If you like to use this action with mailing whois lines, you could use the composite action
# action_cf_mwl predefined in jail.conf, just define in your jail:
#
# action = %(action_cf_mwl)s
# # Your CF account e-mail
# cfemail  = 
# # Your CF API Key
# cfapikey = 

cftoken = xxx

cfuser = xxx
  • i just changed backend from auto to polling and now its working... – elliot. Aug 28 '18 at 11:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.