1

I have an event source running regularly. The problem is that http-get-dos from fail2ban will catch the IP if the user left the tab open for a large amount of time.

So , I am thinking, how can I disable this type of specific log in ningx? The alternative is to configure fail2ban to ignore this pattern.

"GET /users/stream HTTP/2.0"

I am willing to implement in nginx or fail2ban.

Probably changing accordingly this line in /etc/fail2ban/filter.d/http-get-dos.conf is the most straightforward way:

failregex = ^<HOST> -.*"(GET|POST).*

Update (/etc/fail2ban/filter.d/http-get-dos.conf):

# Fail2Ban configuration file
[Definition]

# Option: failregex
# Note: This regex will match any GET entry in your logs, so basically all valid and not valid entries are a match.
# You should set up in the jail.conf file, the maxretry and findtime carefully in order to avoid false positives.
failregex = ^<HOST> -.*"(GET|POST).*
# Option: ignoreregex
ignoreregex =

##To stop DOS attack from remote host.
[http-get-dos]
enabled = true
port = http,https
filter = http-get-dos
logpath  = /usr/local/nginx/localhost-access.log
maxretry = 300
findtime = 300
bantime = 600
action = iptables[name=HTTP, port=http, protocol=tcp]

First try: Apparently not working with the regex below:

fail2ban-regex /usr/local/nginx/localhost-access.log '^<HOST> -.*"(GET|POST).*' '^.+?:\d+ <HOST> -.*"(GET) /users/stream.*$'

Running tests
=============

Use   failregex line : ^<HOST> -.*"(GET|POST).*
Use ignoreregex line : ^.+?:\d+ <HOST> -.*"(GET) /users/stream.*$
Use         log file : /usr/local/nginx/localhost-access.log
Use         encoding : UTF-8


Results
=======

Failregex: 22431 total
|-  #) [# of hits] regular expression
|   1) [22431] ^<HOST> -.*"(GET|POST).*
`-

Ignoreregex: 0 total

Second try: But will work with ^<HOST> -.*"(GET) /users/stream.*$

fail2ban-regex /usr/local/nginx/localhost-access.log '^<HOST> -.*"(GET|POST).*' '^<HOST> -.*"(GET) /users/stream.*$'

Running tests
=============

Use   failregex line : ^<HOST> -.*"(GET|POST).*
Use ignoreregex line : ^<HOST> -.*"(GET) /users/stream.*$
Use         log file : /usr/local/nginx/localhost-access.log
Use         encoding : UTF-8


Results
=======

Failregex: 1574 total
|-  #) [# of hits] regular expression
|   1) [1574] ^<HOST> -.*"(GET|POST).*
`-

Ignoreregex: 22093 total
|-  #) [# of hits] regular expression
|   1) [22093] ^<HOST> -.*"(GET) /users/stream.*$
`-
  • You know that you can also ignore IP addresses? – sebix Dec 3 '18 at 19:39
  • @sebix how does that help? – Fel Dec 4 '18 at 10:06
  • Sorry, I misunderstood the question – sebix Dec 4 '18 at 17:48
  • http-get-dos is not a filter shipped with fail2ban. You'll need to include a copy of your configuration in your question. – Michael Hampton Dec 10 '18 at 16:38
2
+50

You're on the right track using the

ignoreregex =

directive in your

/etc/fail2ban/filter.d/http-get-dos.conf

config file. This should just be a matter of tweaking the regex. Something like this:

^<HOST> -.*"(GET) /users/stream.*$

which matches your log file line, then matches for any GET's and only GET's with requests that have the /users/stream prefix, and any string appended to it.

  • 1
    Can you see the update? thanks – Fel Dec 11 '18 at 10:46
  • 1
    It will work with ^<HOST> -.*"(GET) /users/stream.*$ – Fel Dec 11 '18 at 11:09
  • 1
    Thanks, edited regex in the answer to match the working version. – frontsidebus Dec 11 '18 at 16:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.