1

Recently, I installed fail2ban on my server to help prevent bots from abusing the site.

I have the r4032login module installed and it is writing to the log, but it is using HTTP status 302 for the redirect to the login page.

I'm wondering what would be the easiest way to have fail2ban work alongside the r4032login.

Here is a sample log entry:

ddd.ddd.ddd.ddd - - [12/May/2019:14:46:26 -0400] "GET /node/1/edit HTTP/1.1" 302 4305 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36"

https://www.fail2ban.org/wiki/index.php/Main_Page

https://www.drupal.org/project/r4032login

0

For Fail2Ban v0.10.2, I edited two files in the /etc/fail2ban directory.

I added the following entry to jail.local:

[apache-forbidden]
enabled = true
port = http,https
filter = apache-forbidden
logpath = %(apache_access_log)s
maxretry = 3
findtime = 600
bantime  = 600

For filter.d/apache-forbidden.conf I have the following:

[INCLUDES]

before = common.conf

[Definition]

failregex = <HOST> - - .*HTTP/[0-9]+(.[0-9]+)?" 302

The 302 at the end is to reflect the redirect code for r4032login module.

NOTE: 302 redirects by other modules and Apache might also trigger a ban.

  • I would expect all 302 redirects to trigger a ban with these parameters... surely? The saving grace is that normal users don't typically trigger 302 redirects frequently from the same host (unless that host is a NAT external IP for a company or similar). Consequently, I would suggest making sure that the retry parameter is relatively large and the time is relatively short. Monitor the logs over a long-ish period to make sure. If you can, change the "custom log" parameter in apache config so the logs show any additional info that can restrict the ban trigger. – rivimey May 13 at 10:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.