From: Iain L. <ia...@br...> - 2005-11-29 09:56:12
|
After using fail2ban for a while on external servers I have a feature suggestion that I think would make fail2ban a killer security tool :-) One should add a new parse type to fail2ban to be able to block webattacks. I get the following attacks all the time in my webserver logs: 220.137.93.28 - - [24/Nov/2005:00:18:18 +0100] "CONNECT smtp.rol.ru:25 212.204.78.162 - - [27/Nov/2005:16:48:04 +0100] "GET /_vti_bin/owssvr.dll?UL=1&ACT=4&BUILD=6254&STRMVER=4&CAPREQ=0 HTTP/1.1" 404 212.204.78.162 - - [27/Nov/2005:16:48:04 +0100] "GET /MSOffice/cltreq.asp?UL=1&ACT=4&BUILD=6254&STRMVER=4&CAPREQ=0 HTTP/1.1" 404 218.89.167.126 - - [28/Nov/2005:11:20:12 +0100] "GET /sumthin HTTP/1.0" What I envision is a new [ATTACK] keyword/section in the config file: [ATTACK] # Option: enabled # Notes.: enable monitoring for this section. # Values: [true | false] Default: false # enabled = true # Option: logfile # Notes.: logfile to monitor. # Values: FILE Default: /var/log/httpd/access_log # logfile = /var/log/httpd/access_log # Option: attackfile # Notes.: file containing attacks to block # Values: FILE Default: /etc/fail2ban.dat # attackfile = /etc/fail2ban.dat (rest of config to enable blocking/unblocking etc.) The attack matching and blocking file would based on the above logfile entries could be: ^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* - - \[.\*] "CONNECT .* - - .* "GET /_vti_bin/ GET /MSOffice /sumthin HTTP With the external file read in and parse ability fail2ban would be a very powerful tool and could be used to block numerous types of bad activity. Regards Iain -- +49-172-8196039 Skype: iain.lea |