apache 2.4 with basic authentication and fail2ban apache-auth

Question

It seems I have a conflict in my configuration on CentOS 7 server.

The issue appears between vhost configuration on apache 2.4 (httpd) with the basic authentication and fail2ban apache-auth banning feature.

I want two things :

1) An authentication for access to my each websites with basic authentication feature.

2) Ban IP with fail2ban from apache errorlog files.

My problem is :

• If I have "Deny from all" in location tag inside of vhost configuration file so I have prompt for authentication but I have too lot of errors in apache errorlog file --> "AH01797: client denied by server configuration"

• However, if I change "Deny from all" by "Require all granted", the issue dispears but the prompt authentication too obviously.

How can I have this two features together, without conflict?

I hope this is clear. Please ask for any additional information needed.

Answer 1

I hope this is clear.

Well not really. Either the issue is that fail2ban doesn't recognize AH01797: client denied but you want it'd happen (then see P.1), or vice versa it find that but you don't want that (then see P.2)

1. Normally fail2ban's apache-auth should detect this kind of failures. If it does not either your fail2ban version (or config file) are too old, or you've some different log (compare it with this or provide an example of your log).

2. If you want that fail2ban ignores this, just open /etc/fail2ban/filter.d/apache-auth.conf (make a backup) and remove the rule for this, for example for newest version it would be something like this:

- failregex = ^client (?:denied by server configuration|used wrong authentication scheme)\b
+ failregex = ^client (?:used wrong authentication scheme)\b