Hi Team,
First of all thanks for you investing precious time to help for beginners like me .
I have installed failed 2 ban in centos
in my haproxy logs
Mar 7 02:37:07 localhost haproxy[9378]: 115.xxx.xxx.xxx:19004 [07/Mar/2015:02:37:03.823] http-ingress learnexa/prodapp01 2952/0/0/17/3242 302 689 - - --VN 3/3/0/0/0 0/0 "GET /myadmin/scripts/setup.php HTTP/1.1"
how to block
i have done below steps if any mistake pls correct it
===========================================================
vim /etc/fail2ban/filter.d/vulscan.conf
[Definition]
failregex = ^<HOST>.*\"GET
ignoreregex =
============================================================
[vulscan]
enabled = true
port = http,https
filter = vulscan
banaction = iptables-allports
logpath = /var/log/haproxy_0.log
#action = hostsdeny[file=/etc/hosts.deny]
action = iptables-multiport[name=vulscan, port="http,https", protocol=tcp]
maxretry = 1
bantime = 604800
=====================================================================
iptables -L "ouput pasted below "
Chain INPUT (policy ACCEPT)
target prot opt source destination
fail2ban-vulscan tcp -- anywhere anywhere multiport dports http,https
fail2ban-SSH tcp -- anywhere anywhere tcp dpt:ssh
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain fail2ban-SSH (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain fail2ban-vulscan (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere