1

I am using fail2ban to try and block any IP that gets multiple failed logins, a failed login is recorded in our application log as "/login.html?success=no".

So I have created a fail2ban .conf, but I can't get it to find any matches, however when I use this site, it highlights the line fine. My .conf looks like so:

[Definition]

failregex = .*<HOST>.*login\.html\?success=no

ignoreregex =

But when I run "fail2ban-regex" to test it, it doesn't find any matches:

fail2ban-regex test.log /etc/fail2ban/filter.d/nginx-test.conf

Results

=======

Failregex: 0 total

Ignoreregex: 0 total

The log file I am using looks like:

|  2017/10/03 10:11:53 [error] 14870#14870: *51 access forbidden by rule, client: 1.2.3.4, server: example.com, request: "GET /robots.txt HTTP/1.1", host: "example.com"
|  2017/10/03 10:11:53 [warn] 14870#14870: *50 delaying request, excess: 0.545, by zone "base", client: 1.2.3.4, server: example.com, request: "GET /login.html?success=no HTTP/1.1", host: "example.com", referrer: "https://example.com/"
1
  • 1
    According to the fail2ban documentation, the <HOST> matched in your log line would be "GET. But apart from that, are you sure fail2ban recognizes your timestamps?
    – melpomene
    Oct 3, 2017 at 12:46

1 Answer 1

1

My regex needed to be:

.*client: <HOST>.*request: "GET \/login\.html\?success=no HTTP/1.1"

Thanks to @melpomene for pointing me in the right direction, my <HOST> wasn't even pointing at the IP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.