fail2ban & Apache: no banning

peng12 · 01-13-2015, 11:24 AM

Hello,

I've Debian 8.0 (testing) with fail2ban 0.9, Apache 2.4 and mod_evasive.

While fail2ban is working fine blocking unwanted "ssh-visitors", I've a problem with fail2ban and Apache: "Bad users are not being blocked".

My configuration files:

/etc/apache2/mods-enabled/evasive.conf

Code:

<IfModule mod_evasive20.c>
    DOSHashTableSize    3097
    DOSPageCount        2
    DOSSiteCount        50
    DOSPageInterval     1
    DOSSiteInterval     1
    DOSBlockingPeriod   10
   DOSLogDir           "/var/log/apache2/mod_evasive"
</IfModule>

added to /etc/fail2ban/jail.local

Code:

[apache-dosevasive]
enabled = true
filter  = apache-dosevasive
action = iptables-allports[name=dos]
logpath = /var/log/apache2/error.log
bantime = 600
maxretry = 10

/etc/fail2ban/filter.d/apache-dosevasive.conf

Code:

# Fail2Ban configuration file
#
# Author: Xela
#
# $Revision: 728 $
#

[Definition]

# Option:  failregex
# Notes.:  regex to match the Forbidden log entrys in apache error.log
#          maybe (but not only) provided by mod_evasive
#
# Values:  TEXT
#
failregex = ^\^\*\]\s+\[error\]\s+\[client <HOST>\] client denied by server configuration:\s

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

/var/log/apache/error.log

Code:

[Tue Jan 13 18:08:30.968445 2015] [evasive20:error] [pid 20154] [client 1.2.3.4:1234] client denied by server configuration: /var/www/html/com.example/htdocs/index.html
[ ~ repeated approx. 20 times ]

however, as said before: fail2ban is not blocking those requests.

Code:

Chain INPUT (policy DROP)
# ....
f2b-dos    tcp  --  anywhere             anywhere
# ....

Chain f2b-dos (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Does anyone knows why?

Thanks in advance

Habitual · 01-13-2015, 11:28 AM

What does

Code:

fail2ban-regex /var/log/apache2/error.log /etc/fail2ban/filter.d/apache-dosevasive.conf

show?
Does it "hit" or miss on the log file?

peng12 · 01-13-2015, 11:31 AM

Quote:

Originally Posted by Habitual

What does

Code:

fail2ban-regex /var/log/apache2/error.log /etc/fail2ban/filter.d/apache-dosevasive.conf

show?
Does it "hit" or miss on the log file?

Thanks for your quick answer.

Result

Code:

Running tests
=============

Use   failregex file : /etc/fail2ban/filter.d/apache-dosevasive.conf
Use      single line : /var/log/apache2/error.log


Results
=======

Failregex: 0 total

Ignoreregex: 0 total

Date template hits:

Lines: 1 lines, 0 ignored, 0 matched, 1 missed [processed in 0.00 sec]
|- Missed line(s):
|  /var/log/apache2/error.log

I guess the problem is the regular expression which is not matching?

Miati · 01-13-2015, 12:09 PM

Hi, I had pretty much this identical problem.

The question and fix is posted here
Basically the problem boils down to outdated regex files.
Upvote the question if you can (for some reason it got downvoted despite it being a valid problem, go figure)