2

I'm getting a large number of sql injection attempts that all look alike on a daily basis. A snippet from the access logs shows:

8222 24.247.182.172 - - [09/Nov/2018:08:47:25 -0600] ***************.com "GET /Add_Product.php?strPhotoID=VA1209&price_selected=2+union+select+0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526--&page_id=912 HTTP/1.1" 302 0 "https://www.***************.com/Add_Product.php?strPhotoID=VA1209&price_selected=2+union+select+0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526--&page_id=912" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "-"

This is the configuration in jail.local:

[sql-union-select-attack]
enabled = true
filter = sql-union-select-attack
logpath = /var/log/nginx/*access.log
port = 8221,8222,8231,8232
maxretry = 1
findtime = 10
bantime = -1
action = iptables-allports[name=sqlUnionSelect]

Here is the filter (sql-union-select-attack.conf):

#The SQL Injection attempt with "union+select+" in the URL
[Definition]
failregex = ^\d{4} <HOST> -.*\"(GET|POST).*/Add_Product.php.*union

Yet here I am, getting no bans as shown with

fail2ban-client status sql-union-select-attack

    root@web4:/etc/fail2ban# fail2ban-client status sql-union-select-attack
    Status for the jail: sql-union-select-attack
    |- Filter
    |  |- Currently failed: 0
    |  |- Total failed: 0
    |  `- File list:    /var/log/nginx/**************.access.log /var/log/nginx/access.log
    `- Actions
       |- Currently banned: 0
       |- Total banned: 0
       `- Banned IP list:   

What is going on here? Is something incorrect with my jail.local configuration?

Edit

Thanks to Michael Hampton's answer, it appears to be working now. I have a bash script that lets me select a jail to get the status:

root@web4:/etc/fail2ban# get_jail_status 
http-get-dos
http-post-dos
magento-url
megaindex-crawler-spam
nginx-499
nginx-aspx-url
sql-directory-attempt
sql-union-select-attack
sshd
Please enter the jail you would like to check: 
sql-union-select-attack
Status for the jail: sql-union-select-attack
|- Filter
|  |- Currently failed: 0
|  |- Total failed: 2
|  `- File list:    /var/log/nginx/**************.access.log /var/log/nginx/access.log
`- Actions
   |- Currently banned: 5
   |- Total banned: 5
   `- Banned IP list:   142.163.212.50 217.61.108.219 37.59.8.29 207.228.228.8 162.144.126.204

If I select one of those IP addresses and check it in iptables, it appears:

root@web4:/etc/fail2ban# iptables -L -v -n | grep 142.163.212.50
0     0 REJECT     all  --  *      *       142.163.212.50       0.0.0.0/0            reject-with icmp-port-unreachable

So it appears to be working!

  • Check your jail.conf and see what the default backend is set to? – Michael Hampton Nov 9 '18 at 15:24
  • It is set to backend = auto – IRGeekSauce Nov 9 '18 at 15:34
  • Make sure you have pyinotify installed, then, or reinstall it, e.g.: sudo apt-get install --reinstall python-pyinotify – Michael Hampton Nov 9 '18 at 15:35
  • It was not installed. Just installed it. Should I restart the fail2ban-client? – IRGeekSauce Nov 9 '18 at 15:36
  • Yes, you'll need to restart fail2ban. It can't read log files (other than the systemd journal) without pyinotify. – Michael Hampton Nov 9 '18 at 15:40
2

Fail2ban needs to have pyinotify installed to read log files other than via the systemd journal. If it isn't installed, then you should install or reinstall it. For example:

sudo apt-get install python-pyinotify

After that, restart fail2ban and wait a few minutes for it to chew through the existing log files.

(Technically it can also use gamin, but historically that hasn't been very reliable...)

  • Edited my question to show that your answer worked. Thank you! – IRGeekSauce Nov 9 '18 at 15:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.