Fail2ban Httpd

Posted on 02-05-2021 by admin

Fail2ban Https
Fail2ban Apache Httpd
Fail2ban Centos7 Httpd

TinyCP has a really nice Fail2ban interface and I managed to add a few tweaks to allow further granular control. In this post, I will demonstrate how to add 'Apache 404' and 'Apache Anti-Bots'. Ensure Fail2ban is installed and operational. This guide is based on Ubuntu 18.04. Edit /etc/fail2ban/jail.conf as follows; apache-404-noscript. Fail2ban scans log files for various services ( SSH, FTP, SMTP, Apache, etc., ) and bans the IP that makes too many password failures. It also updates the firewall rules to reject these ip addresses. Fail2ban is an intrusion prevention framework written in the Python programming language. Main purpose of Fail2ban is to.

Hello,
I've all my services (postfix, dovecot, sasl, ..) secure with fail2ban,
but only httpd doesn't work
[code]404 Not Found
//%0D/scripts/setup.php: 2 Time(s)
//3rdparty/phpMyAdmin/scripts/setup.php: 1 Time(s)
//81/phpmyadmin/scripts/setup.php: 1 Time(s)

//Admin/: 1 Time(s)
//Admin/scripts/setup.php: 1 Time(s)
//MyAdmin/: 1 Time(s)
//MyAdmin/scripts/setup.php: 1 Time(s)
//MySQLAdmin/scripts/setup.php: 1 Time(s)
//PHPMYADMIN/scripts/setup.php: 2 Time(s)
//PMA/: 1 Time(s)
//PMA/scripts/setup.php: 2 Time(s)

//PMA2/scripts/setup.php: 1 Time(s)
//PMA2009/scripts/setup.php: 2 Time(s)
//PMA3/scripts/setup.php: 2 Time(s)
//SQL/scripts/setup.php: 2 Time(s)
//SSLMySQLAdmin/scripts/setup.php: 1 Time(s)
//_PHPMYADMIN/scripts/setup.php: 2 Time(s)
//_admin/scripts/setup.php: 1 Time(s)
//_pHpMyAdMiN/scripts/setup.php: 2 Time(s)
//_phpMyAdmin/scripts/setup.php: 1 Time(s)
//_phpmyadmin/scripts/setup.php: 1 Time(s)
//admin/: 1 Time(s)
//admin/mysql/scripts/setup.php: 2 Time(s)
My /etc/fail2ban/filter.d/apache.conf:
failregex = [[]client <HOST>[]] (File does not exist|script not found or
unable to stat): .*(.php|.asp|.exe|.pl)
Test:
[root@web ~]# fail2ban-regex /var/log/httpd/error_log
/etc/fail2ban/filter.d/apache.conf
/usr/share/fail2ban/server/filter.py:430: DeprecationWarning: the md5
module is deprecated; use hashlib instead
import md5
Running tests
Use regex file : /etc/fail2ban/filter.d/apache.conf
Use log file : /var/log/httpd/error_log
Results
Failregex
|- Regular expressions:
| [1] [[]client <HOST>[]] (File does not exist|script not found or

Fail2ban Https

unable to stat): .*(.php|.asp|.exe|.pl)
|
`- Number of matches:
[1] 0 match(es)
Ignoreregex
|- Regular expressions:
|
`- Number of matches:
Summary
Sorry, no match[/code][Moderator edit: Added [i]code[/i] tags to preserve formatting.]
How can I stop such tests?
Gruß
Andreas Reschke

Apache HTTP Server is a free software/open source web server for Unix-like systems, Microsoft Windows, Novell NetWare and other operating systems. Apache is notable for playing a key role in the initial growth of the World Wide Web, and continues to be the most popular web server in use, serving as the de facto reference platform against which other web servers are designed and judged.

Sophos home security.

[Sun Jan 28 11:55:32 2007] [error] [client 123.123.123.123] user myCoolUser: authentication failure for '/myPasswordedDir': Password Mismatch
[Tue Apr 10 15:39:26 2007] [error] [client x.x.x.x] Digest: user Username: password mismatch: /
[Tue Jan 27 15:32:40 2009] [error] [client 192.0.2.1] client denied by server configuration: /var/www/apache2-default/nonexistingpage.html

Failregex

The regular expressions below are proposed failregex for this software. Multiple regular expressions for failregex will only work with a version of Fail2ban greater than or equal to 0.7.6.

Fail2ban Apache Httpd

The tag <HOST> in the regular expressions below is just an alias for (?:::f{4,6}:)?(?P<host>S+). The replacement is done automatically by Fail2ban when adding the regular expression. At the moment, exactly one named group host or <HOST> tag must be present in each regular expression.

Please, before editing this section, propose your changes in the discussion page first.

Authentication failure (doesn't it match to many cases ?):

[[]client <HOST>[]] user .*(?:: authentication failure|not found|password mismatch)

Drivers rps spa - avs port devices. Forbidden access:

* ^[[^]]*]s+[error]s+[client <HOST>] client denied by server configuration:

Fail2ban Centos7 Httpd

PHP

If you don't have PHP service running or do not expect so many 'File does not exist' logging in Apache's error log, for attempts to log into some admin modus as shown below, you can also ban these IPs.

[Sat Mar 15 03:08:59 2008] [error] [client xyz.246.51.abc] File does not exist: /var/www/blabla/sqladmin/main.php
[Sat Mar 15 03:08:59 2008] [error] [client xyz.246.51.abc] File does not exist: /var/www/blabla/php/main.php
[Sat Mar 15 03:08:59 2008] [error] [client xyz.246.51.abc] File does not exist: /var/www/blabla/myadmin/main.php

This can be done by using the following regex in an extra Apache section in fail2ban.conf:

failregex = [[]client (?P<host>S*)[]] File does not exist: .*.php

A more comprehensive example for a Apache with PHP on Linux, running PHPBB, but without PHPmyAdmin, cgi, perl:

To block certain WordPress and other PHP related vulnerabilities, a failregex may be added to one of the apache filters (filter.d/apache-auth.conf for example):

[[]client <HOST>[]] PHP Notice:.*(Undefined variable: HTTP_.*_VARS in|Use of undefined constant include_path).*
[[]client <HOST>[]] PHP Deprecated:.*(Function set_magic_quotes_runtime() is deprecated in|Assigning the return value of new by reference is deprecated in).*

Centos

Under CentOS / RedHat Enterprise Linux, httpd (Apache) is not compiled with tcpwrappers support. As a result the example in jail.conf called 'apache-tcpwrapper' does not work since /etc/hosts.deny does not affect apache.

Retrieved from 'http://www.fail2ban.org/wiki/index.php?title=Apache&oldid=4403'

Coments are closed

Rrfox983