0

Every day I see hackers/script kiddies looking for url's like:

/webdav
/site.tar
/admin
/htdocs.php

etc. They sometimes hit my sites for several minutes looking for common exploits. Is there a publicly available fail2ban filter for these types of attacks on apache? I can't imagine everyone is rolling their own.

  • How about the ones that are included with fail2ban? – Michael Hampton Nov 29 '18 at 21:49
  • I looked at all of the apache-* filters and none seem to look for these words. I see filtering for bots, home pages, certain errors, etc. but not common bad pages / directories – TSG Nov 30 '18 at 16:37
  • 1
    Those are not really bad URLs though, as they correspond to software people actually install and use on their servers. What's bad is the bots repeatedly hitting them. It's also trivial to write your own filter if you do want to block them by URL, but it's probably not worth the additional trouble. – Michael Hampton Nov 30 '18 at 16:49
0

I recommend configuring apache to not log anything around these locations that you frequently get 404 message on. That way the CPU and disk IO saved writing the logs can be used for your real visitors.

CPU/IO time is also saved when you don't need fail2ban to scan through the logs (regexes of fail2ban is a large user of CPU resources).

Also, every real visitor is saved from being subject to IP/nftables rules slowing down their access.

You'll also be saved the anguish of looking at the logs and focusing on the background noise of the internet rather than the real visitors you care about.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.