0

In the last few weeks I've been having some problems with some users who are scanning our server for files, and in those searches they generate a lot of errors.

That's why I installed fail2ban, it turns out that not all the errors I've been detecting are available on fail2ban.

The errors I found the most are these below:

[Sat Jul 08 11:37:30.603227 2023] [authz_core:error] [pid 4634] [client 192.168.0.1:35328] AH01630: client denied by server configuration: /var/www/html/application/info.php
[Sat Jul 08 11:32:59.544089 2023] [core:error] [pid 4692] [client 192.168.0.1:59046] AH00082: an unknown filter was not added: includes
[Sat Jul 08 11:04:53.306361 2023] [autoindex:error] [pid 9263] [client 192.168.0.1:45763] AH01276: Cannot serve directory /var/www/html/assets/third-party/bootstrap/: No matching DirectoryIndex (index.php,index.html,index.cgi,index.pl,index.php,index.xhtml,index.htm) found, and server-generated directory index forbidden by Options directive
[Sat Jul 08 11:24:54.226786 2023] [http:error] [pid 4693] [client 192.168.0.1:47012] AH02430: Response header 'Location' value of 'https://example.com/xyz\n\n<script>alert(1234);</script>abc.jsp' contains invalid characters, aborting request

How do I create a regex that can catch these errors?

2 Answers 2

1

This is generic internet scanning traffic caused by, amongst other things, botnets. It will change constantly as new vulnerabilities come out and you're about to opt into an endless job of writing fail2ban rules for no real reason.

I would rather suggest you spend the time to configure Apache so that requests sent to http://yourip/nosuchfile do not hit the same virtualhost as your main application. That way you'll keep all the automated scanner noise (and exploits) away from your application files and logs.

0

Apart from the sensuality that bans (beginning with a long-term right to exist and ending with the false positives question)...
Just as an example how it may look:

failregex = ^(?:\[\] )?\[(?:(?:authz_)?core|autoindex|http):error\] \[pid \d+\] \[client <ADDR>:\d+\] \S+: (?:client denied|an unknown filter|Cannot serve directory|Response header)\b

alternative variant using prefregex (just to illustrate different ways):

prefregex = ^(?:\[\] )?\[(?:(?:authz_)?core|autoindex|http):error\] \[pid \d+\] \[client <ADDR>:\d+\]\s+<F-CONTENT>.+</F-CONTENT>$
failregex = ^AH01630: client denied\b
            ^AH00082: an unknown filter\b
            ^AH01276: Cannot serve directory\b
            ^AH02430: Response header\b

Although some of them are really questionable, especially the last with Response header .... I can understand if that would be Request header, so would signal a request contains something "incorrect", but it looks like something checks the response (that generated by your server/backend/whatever), I don't follow how it'd be incorrect and must be banned.
Anyway ensure you set appropriate maxretry and findtime for that jail.
Also note fail2ban :: wiki :: Best practice.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .