Earlier I posted how to use a text file created by a script to similarly manage the rogue IPs that Fail2ban bans. The problem with using scripts and crontab is that it is not reporting in real-time. The method here works in real-time because Fail2ban reports directly to the MySQL on the control server. On each remote you’ll want to...
Step 1 Create Database and Tables in MySQL Add a “source” field for the server name if you want to use a remote database setup (and add it to the UNIQUE KEY).The UNIQUE KEY prevents duplicates of course. But this means you can refresh the perl script without handling duplicates there which would complicate things considerably. CREATE TABLE iptable (...
fail2ban.actions.action: ERROR iptables -D INPUT -p tcp -m multiport –dports http,https -j fail2ban-apache-xxxxxxxxxxxxxxxxxxx iptables -F fail2ban-apache-xxxxxxxxxxxxxxxxxxx iptables -X fail2ban-apache-xxxxxxxxxxxxxxxxxxx returned 200 iptables only allows rules of up to 30 characters Shorten the name of the conf file solves the error
Customize apache2 other_vhosts_access.log format so fail2ban can use it. sudo vi /etc/apache2/apache2.conf On line 255 insert LogFormat “%t %v:%p %h %l %u \”%r\” %>s %O \”%{Referer}i\” \”%{User-Agent}i\”” fail2ban Comment out the following line #LogFormat “%v:%p %h %l %u %t \”%r\” %>s %O \”%{Referer}i\” \”%{User-Agent}i\”” vhost_combined sudo vi /etc/apache2/conf.d/other-vhosts-access-log change the end of the line (or duplicate and comment out) as...
Changing banaction to ROUTE worked, while IPTABLES-ALLPORTS failed with error No Host Found 2014-09-26 10:55:24,662 fail2ban.filter : ERROR No ‘host’ found in ‘113.71.191.49 – – [ +0000] “GET /phpMyAdmin/scripts/setup.php HTTP/1.1” 500 833 “-” “-” ‘ using ‘‘ [apache-phpmyadmin-access] enabled = true #banaction = iptables-allports banaction = route port = http,https filter = apache-phpmyadmin-access logpath = /var/log/apache2/access.log maxretry = 0 #...
My Notes Only taken from various sources. There are other much more complete guides for Fail2ban available. Install Fail2ban sudo apt-get install fail2ban filter definitions located in /etc/fail2ban/filter.d action definitions located in /etc/fail2ban/action.d The following is a minimal setup. Configure Fail2ban sudo vi /etc/fail2ban/jail.conf Configuration for jail.conf destemail = you@example.com # Email of where alerts should be sent to ignoreip...