Comments on 2018-08-24 Out of Memory

I guess if I wanted to have a solution that also worked for Gopher (see 2018-07-15 Russian Gopher Idiots at Work), I cannot rely on solutions based on Apache, tempting as they are. It would have to be some sort of firewall. @sheogorath recommended taking another look at fail2ban (which I already use), so that’s promising. Must look at /etc/fail2ban/filter.d/, tomorrow.

Here’s their toot on it:

The fail2ban daemon watches specified logs and log files for changes (like you can do with journalctl -f) and passes the content to a regex. These regex’ are specified in /etc/fail2ban/filter.d/.

You only have to enable them in /etc/fail2ban/jail.local or /etc/fail2ban/jail.d.

Given that a regex matches the specific number of times in the specified time, it’ll trigger an action, like ban the ip in the firewall. These are specified in /etc/fail2ban/action.d.

– Alex Schroeder 2018-08-24 22:45 UTC


OK, first attempt...

This is the filter for my Apache access.log file, stored in /etc/fail2ban/filter.d/alex-apache.conf:

# Author: Alex Schroeder <alex@gnu.org>

[Definition]
# ANY match in the logfile counts!
# communitywiki.org:443 000.000.000.000 - - [24/Aug/2018:16:59:55 +0200] "GET /wiki/BannedHosts HTTP/1.1" 200 7180 "https://communitywiki.org/wiki\
/BannedHosts" "Pcore-HTTP/v0.44.0"
failregex = ^[^:]+:[0-9]+ <HOST>

# Except cgit!
# alexschroeder.ch:443 0:0:0:0:0:0:0:0 - - [28/Aug/2018:09:14:39 +0200] "GET /cgit/bitlbee-mastodon/objects/9b/ff0c237ace5569aa348f6b12b3c2f95e07fd0d HTTP/1.1" 200 3308 "-" "git/2.18.0"
ignoreregex = ^[^"]*"GET /cgit

This is the filter for the log file of my gopher server, stored in /etc/fail2ban/filter.d/alex-gopher.conf:

# Author: Alex Schroeder <alex@gnu.org>

[Init]
# 2018/08/25-09:08:55 CONNECT TCP Peer: "[000.000.000.000]:56281" Local: "[000.000.000.000]:70"
datepattern = ^%%Y/%%m/%%d-%%H:%%M:%%S

[Definition]
# ANY match in the logfile counts!
failregex = CONNECT TCP Peer: "\[<HOST>\]:\d+"

And this sets up a few jails using these filters, stored in /etc/fail2ban/jail.d/alex.conf:

[alex-apache]
enabled = true
port    = http,https
logpath = %(apache_access_log)s
findtime = 40
maxretry = 20

[alex-gopher]
enabled = true
port    = 70
logpath = /home/alex/farm/gopher-server.log
findtime = 40
maxretry = 20

[alex-gopher-ssl]
enabled = true
filter  = alex-gopher
port    = 7443
logpath = /home/alex/farm/gopher-server-ssl.log
findtime = 40
maxretry = 20

Reload and show status:

# fail2ban-client reload
# fail2ban-client status
Status
|- Number of jail:	4
`- Jail list:	alex-apache, alex-gopher, alex-gopher-ssl, sshd

We’ll see how it goes!

– Alex Schroeder 2018-08-25 07:35 UTC


Well, the situation is pretty much under control, now. I see that fail2ban has between zero and four hosts banned. That looks reasonable, actually.

– Alex Schroeder 2018-08-26 08:07 UTC


The old fail2ban which comes with Debian stable doesn’t support IPv6 addresses but the newer one does.

  1. search for fail2ban package
  2. follow the links to a version 0.10 or better
  3. download file (in my case that meant wget http://ftp.ch.debian.org/debian/pool/main/f/fail2ban/fail2ban_0.10.2-2_all.deb)
  4. install (in my case using dpkg -i fail2ban_0.10.2-2_all.deb)

I have made one change to my /etc/fail2ban/fail2ban.conf: I just want to know about banning and unbanning, not about all the IP numbers seen.

loglevel = NOTICE

– Alex Schroeder 2018-08-27 11:28 UTC


I’ve had to fiddle with the filter again and again. Loading the Munin page, for example, generated enough requests for instant banning. So now I’m trying to find a good place to be where most simple file aren’t considered for banning. This is my current /etc/fail2ban/filter.d/alex-apache.conf.

# Author: Alex Schroeder <alex@gnu.org>

[Definition]
# ANY match in the logfile counts!
# communitywiki.org:443 000.000.000.000 - - [24/Aug/2018:16:59:55 +0200] "GET /wiki/BannedHosts HTTP/1.1" 200 7180 "https://communitywiki.org/wiki/BannedHosts" "Pcore-HTTP/v0.44.0"
failregex = ^[^:]+:[0-9]+ <HOST> 

# Except cgit, css files, images...
# alexschroeder.ch:443 0:0:0:0:0:0:0:0 - - [28/Aug/2018:09:14:39 +0200] "GET /cgit/bitlbee-mastodon/objects/9b/ff0c237ace5569aa348f6b12b3c2f95e07fd0d HTTP/1.1" 200 3308 "-" "git/2.18.0"
ignoreregex = ^[^"]*"GET /(robots\.txt |favicon\.ico |[^/ ]+.(css|js) |cgit/|css/|fonts/|pics/|1pdc/|gallery/|static/|munin/)

– Alex Schroeder 2018-09-04 10:25 UTC


Please make sure you contribute only your own work, or work licensed under the GNU Free Documentation License. Note: in order to facilitate peer review and fight vandalism, we will store your IP number for a number of days. See Privacy Policy for more information. See Info for text formatting rules. You can edit this page if you need to fix typos. You can subscribe to updates by email without leaving a comment.

To save this page you must answer this question:

Please say HELLO.