6

I am using fail2ban 0.9.7 on CentOS 7 along with an Apache reverse proxy, trying to ban bots trying to access my server as an open proxy, such as :

221.8.179.164 - - [10/Jun/2019:22:04:19 +0200] "CONNECT auth.riotgames.com:443 HTTP/1.1" 405 235 "-" "Mozilla/5.0 (Windows NT 6.1; rv:27.0) Gecko/20100101 Firefox/27.0"

Some of these requests return 200 for some reason, although ProxyRequests is turned off.

Here is my configuration :

apache-badhosts.conf

[Definition]
failregex = ^<HOST> - -.*"(GET|POST|HEAD|CONNECT).*(bad_host_1|bad_host_2|bad_host_3).*"$

ignoreregex =

jail.conf

[apache-badhosts]
port     = http,https
# I made sure this is the proper path
logpath  = /var/log/httpd/access_log
bantime  = 172800
maxretry = 1
enabled  = true

And here is the result of fail2ban-regex :

user@host /e/fail2ban> sudo fail2ban-regex /var/log/httpd/access_log /etc/fail2ban/filter.d/apache-badhosts.conf

Running tests
=============

Use   failregex filter file : apache-badhosts, basedir: /etc/fail2ban
Use         log file : /var/log/httpd/access_log
Use         encoding : UTF-8


Results
=======

Failregex: 10797 total
|-  #) [# of hits] regular expression
|   1) [10797] ^<HOST> - -.*"(GET|POST|HEAD|CONNECT).*(bad_host_1|bad_host_2|bad_host_3).*"$
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [13813] Day(?P<_sep>[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
`-

Lines: 13813 lines, 0 ignored, 10797 matched, 3016 missed
[processed in 2.44 sec]

fail2ban.log

The log is pretty much empty, and only shows sshd bans.

Why is fail2ban not banning IPs, although it finds matches using the regex above ?

  • 1
    I'd try to enable notifications and see if they're triggered. I assume you already ran fail2ban-client status and confirmed your custom jail is loaded. – Marco Jun 10 '19 at 22:35
  • Indeed the custom jail is loaded. I also made sure it was loaded with the proper configuration using fail2ban-client -d | grep badhosts. By notifications, do you mean e-mail notifications ? These are disabled right now, but wouldn't they also appear in fail2ban.log anyway ? – ojathelonius Jun 11 '19 at 5:51
  • Well, according to the informations provided fail2ban should ban hosts matching the regex... – Marco Jun 11 '19 at 8:30
  • It definitely should ! I'm wondering if this is not a deeper issue linked to iptables, however fail2ban does not even log any ban attempt... – ojathelonius Jun 11 '19 at 8:32
  • did you find any solution, i've exact same problem – Ergec Jun 15 '19 at 12:03
5

Most probably you don't have pyinotify installed on your system which cause fail2ban to fail getting log file modifications. I had the same problem and fixed it using this.

1.

Install pyinotify

yum install python-inotify

2.

Once it's installed, edit your jail.local and put

[myjail]
...
backend = pyinotify
...

3.

systemctl restart fail2ban
| improve this answer | |
2

Not exactly the solution to the above problem but it may will help others that come here:

For me the problem was, that fail2ban was watching the wrong logfile.

My nginx jails did not work since they used logpath = %(nginx_error_log)s which is /var/log/nginx/error.log. However, all accesses, including 4xx and 5xx, were logged to /var/log/nginx/access.log.

Exchanging %(nginx_error_log)s with %(nginx_access_log)s fixed it.

To see which log file a jail uses you can inspect the startup message of /var/log/fail2ban.log:

Creating new jail 'nginx-http-auth'
Jail 'nginx-http-auth' uses pyinotify {}
Initiated 'pyinotify' backend
Added logfile: '/var/log/nginx/error.log' (pos = 0, hash = da39a3ee5e6b4b0d3255bfef95601890afd80709)
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.