Fail2ban não proibindo a tentativa de injeção de sql

Question

Estou recebendo um grande número de tentativas de injeção de sql que são parecidas diariamente. Um trecho dos registros de acesso mostra:

8222 24.247.182.172 - - [09/Nov/2018:08:47:25 -0600] ***************.com "GET /Add_Product.php?strPhotoID=VA1209&price_selected=2+union+select+0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526--&page_id=912 HTTP/1.1" 302 0 "https://www.***************.com/Add_Product.php?strPhotoID=VA1209&price_selected=2+union+select+0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526--&page_id=912" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "-"

Esta é a configuração em jail.local:

[sql-union-select-attack]
enabled = true
filter = sql-union-select-attack
logpath = /var/log/nginx/*access.log
port = 8221,8222,8231,8232
maxretry = 1
findtime = 10
bantime = -1
action = iptables-allports[name=sqlUnionSelect]

Aqui está o filtro (sql-union-select-attack.conf):

#The SQL Injection attempt with "union+select+" in the URL
[Definition]
failregex = ^\d{4} <HOST> -.*\"(GET|POST).*/Add_Product.php.*union

Ainda aqui estou, não recebendo proibições como mostrado em

fail2ban-client status sql-union-select-attack

    root@web4:/etc/fail2ban# fail2ban-client status sql-union-select-attack
    Status for the jail: sql-union-select-attack
    |- Filter
    |  |- Currently failed: 0
    |  |- Total failed: 0
    |  '- File list:    /var/log/nginx/**************.access.log /var/log/nginx/access.log
    '- Actions
       |- Currently banned: 0
       |- Total banned: 0
       '- Banned IP list:   

O que está acontecendo aqui? Há algo incorreto na minha configuração jail.local?

Editar

Graças à resposta de Michael Hampton, parece estar funcionando agora. Eu tenho um script bash que me permite selecionar uma prisão para obter o status:

root@web4:/etc/fail2ban# get_jail_status 
http-get-dos
http-post-dos
magento-url
megaindex-crawler-spam
nginx-499
nginx-aspx-url
sql-directory-attempt
sql-union-select-attack
sshd
Please enter the jail you would like to check: 
sql-union-select-attack
Status for the jail: sql-union-select-attack
|- Filter
|  |- Currently failed: 0
|  |- Total failed: 2
|  '- File list:    /var/log/nginx/**************.access.log /var/log/nginx/access.log
'- Actions
   |- Currently banned: 5
   |- Total banned: 5
   '- Banned IP list:   142.163.212.50 217.61.108.219 37.59.8.29 207.228.228.8 162.144.126.204

Se eu selecionar um desses endereços IP e verificá-lo no iptables, ele aparecerá:

root@web4:/etc/fail2ban# iptables -L -v -n | grep 142.163.212.50
0     0 REJECT     all  --  *      *       142.163.212.50       0.0.0.0/0            reject-with icmp-port-unreachable

Então, parece estar funcionando!

    

Answer 1

O Fail2ban precisa ter o pyinotify instalado para ler arquivos de log que não sejam através do diário do systemd. Se não estiver instalado, você deverá instalar ou reinstalá-lo. Por exemplo:

sudo apt-get install python-pyinotify

Depois disso, reinicie o fail2ban e espere alguns minutos para ele mastigar os arquivos de log existentes.

(Tecnicamente também pode usar gamin, mas historicamente isso não tem sido muito confiável ...)