fail2ban haproxy logs based block how to

265 views
Skip to first unread message

newbee

unread,
Mar 7, 2015, 2:51:49 AM3/7/15
to sea...@googlegroups.com
Hi Team,
                First of all thanks for you investing precious time to help for beginners like me . 

I have installed failed 2 ban in centos 


in my haproxy logs 

Mar  7 02:37:07 localhost haproxy[9378]: 115.xxx.xxx.xxx:19004 [07/Mar/2015:02:37:03.823] http-ingress learnexa/prodapp01 2952/0/0/17/3242 302 689 - - --VN 3/3/0/0/0 0/0 "GET /myadmin/scripts/setup.php HTTP/1.1"

how to block 

i have done below steps if any mistake pls correct it 

===========================================================
vim /etc/fail2ban/filter.d/vulscan.conf 



[Definition]

failregex = ^<HOST>.*\"GET

ignoreregex =
============================================================

[vulscan]
enabled = true
port = http,https
filter = vulscan
banaction = iptables-allports
logpath = /var/log/haproxy_0.log
#action   = hostsdeny[file=/etc/hosts.deny]
action = iptables-multiport[name=vulscan, port="http,https", protocol=tcp]
maxretry = 1
bantime = 604800

=====================================================================
iptables -L           "ouput pasted below "



Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
fail2ban-vulscan  tcp  --  anywhere             anywhere            multiport dports http,https 
fail2ban-SSH  tcp  --  anywhere             anywhere            tcp dpt:ssh 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain fail2ban-SSH (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-vulscan (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere  



Reply all
Reply to author
Forward
0 new messages