Ничего не происходит даже при том, что это обнаруживает в журналах. Это не блокирует IP. Это хорошо работает forVSFTP, но не для апача. Помогите. Вы видите конфигурацию и журнал ниже.
файл конфигурации jail.local:
[apache]
enabled = true
port = 80,443
filter = apache-auth
logpath = /var/log/apache*/*error.log
maxretry = 2
# default action is now multiport, so apache-multiport jail was left
# for compatibility with previous (<0.7.6-2) releases
[apache-multiport]
enabled = true
port = http,https
filter = apache-auth
logpath = /var/log/apache*/*error.log
maxretry = 6
Подлинный Apache файл конфигурации
[INCLUDES]
before = apache-common.conf
[Definition]
failregex = ^%(_apache_error_client)s user .* (authentication failure|not found|password mismatch)\s*$
ignoreregex =
Журнал ошибок Apache:
[Fri Jul 25 11:31:20.758218 2014] [auth_basic:error] [pid 4959] [client 8.8.8.8:12767] AH01617: user GOLD: authentication failure for "/Folder": Password Mismatch
[Fri Jul 25 11:31:22.941978 2014] [auth_basic:error] [pid 4959] [client 8.8.8.8:12767] AH01618: user asd not found: /Folder
результат fail2ban-regex:
Running tests
=============
Use regex file : /etc/fail2ban/filter.d/apache-auth.conf
Use log file : /var/log/apache2/error.log
Matched time template MONTH Day Hour:Minute:Second
Matched time template MONTH Day Hour:Minute:Second
Matched time template MONTH Day Hour:Minute:Second
Matched time template MONTH Day Hour:Minute:Second
Matched time template MONTH Day Hour:Minute:Second
Results
=======
Failregex: 0 total
Ignoreregex: 0 total
Summary
=======
Sorry, no match
Журнал Fail2Ban:
2014-07-25 15:16:49,010 fail2ban.filter.datedetector: DEBUG Matched time template MONTH Day Hour:Minute:Second
2014-07-25 15:16:49,010 fail2ban.filter.datedetector: DEBUG Sorting the template list
2014-07-25 15:16:49,011 fail2ban.filter.datedetector: DEBUG Winning template: MONTH Day Hour:Minute:Second with 994 hits
2014-07-25 15:16:52,214 fail2ban.filter : DEBUG Default Callback for Event: <Event dir=False mask=0x2 maskname=IN_MODIFY name='' path=/var/log/apache2/error.log pathname=/var/log/apache2/error.log wd=2 >
2014-07-25 15:16:52,214 fail2ban.filter.datedetector: DEBUG Matched time template MONTH Day Hour:Minute:Second
2014-07-25 15:16:52,215 fail2ban.filter.datedetector: DEBUG Sorting the template list
2014-07-25 15:16:52,215 fail2ban.filter.datedetector: DEBUG Winning template: MONTH Day Hour:Minute:Second with 995 hits
2014-07-25 15:16:52,215 fail2ban.filter : DEBUG Default Callback for Event: <Event dir=False mask=0x2 maskname=IN_MODIFY name='' path=/var/log/apache2/error.log pathname=/var/log/apache2/error.log wd=2 >
2014-07-25 15:16:52,215 fail2ban.filter.datedetector: DEBUG Matched time template MONTH Day Hour:Minute:Second
2014-07-25 15:16:52,215 fail2ban.filter.datedetector: DEBUG Sorting the template list
2014-07-25 15:16:52,215 fail2ban.filter.datedetector: DEBUG Winning template: MONTH Day Hour:Minute:Second with 995 hits
2014-07-25 15:16:52,215 fail2ban.filter : DEBUG Default Callback for Event: <Event dir=False mask=0x2 maskname=IN_MODIFY name='' path=/var/log/apache2/error.log pathname=/var/log/apache2/error.log wd=2 >
2014-07-25 15:16:52,216 fail2ban.filter.datedetector: DEBUG Matched time template MONTH Day Hour:Minute:Second
2014-07-25 15:16:52,216 fail2ban.filter.datedetector: DEBUG Sorting the template list
2014-07-25 15:16:52,216 fail2ban.filter.datedetector: DEBUG Winning template: MONTH Day Hour:Minute:Second with 995 hits
2014-07-25 15:16:54,790 fail2ban.filter : DEBUG Default Callback for Event: <Event dir=False mask=0x2 maskname=IN_MODIFY name='' path=/var/log/apache2/error.log pathname=/var/log/apache2/error.log wd=2 >
2014-07-25 15:16:54,791 fail2ban.filter.datedetector: DEBUG Matched time template MONTH Day Hour:Minute:Second
2014-07-25 15:16:54,791 fail2ban.filter.datedetector: DEBUG Sorting the template list
2014-07-25 15:16:54,791 fail2ban.filter.datedetector: DEBUG Winning template: MONTH Day Hour:Minute:Second with 996 hits
2014-07-25 15:16:54,791 fail2ban.filter : DEBUG Default Callback for Event: <Event dir=False mask=0x2 maskname=IN_MODIFY name='' path=/var/log/apache2/error.log pathname=/var/log/apache2/error.log wd=2 >
2014-07-25 15:16:54,792 fail2ban.filter.datedetector: DEBUG Matched time template MONTH Day Hour:Minute:Second
2014-07-25 15:16:54,792 fail2ban.filter.datedetector: DEBUG Sorting the template list
2014-07-25 15:16:54,792 fail2ban.filter.datedetector: DEBUG Winning template: MONTH Day Hour:Minute:Second with 996 hits
2014-07-25 15:16:54,792 fail2ban.filter : DEBUG Default Callback for Event: <Event dir=False mask=0x2 maskname=IN_MODIFY name='' path=/var/log/apache2/error.log pathname=/var/log/apache2/error.log wd=2 >
Попробуйте воспользоваться официальным файлом apache-auth.conf
:
https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/apache-auth.conf
Как уже упоминалось, попробуйте более новый / самый новый фильтр apache-auth.conf
.
Но вы также должны использовать более новый apache-common. conf
.
( https://github.com/fail2ban/fail2ban/tree/0.10/config/filter.d )
Это очень важно, поскольку он устанавливает регулярное выражение «префикс» журнала. (" _apache_error_client
").
После правильной настройки префикса И основного фильтра аутентификации пакет Fail2Ban под Ubuntu 14.04 или новее-найдет совпадения в ваших журналах ошибок.