[Fail2ban-users] fail2ban idea - dynamic regex blocking

[Iain L. <ia...@br...>]

After using fail2ban for a while on external servers I have a
feature suggestion that I think would make fail2ban a killer
security tool :-)

One should add a new parse type to fail2ban to be able to block webattacks.
I get the following attacks all the time in my webserver logs:

  220.137.93.28 - - [24/Nov/2005:00:18:18 +0100] "CONNECT smtp.rol.ru:25
  212.204.78.162 - - [27/Nov/2005:16:48:04 +0100] "GET
    /_vti_bin/owssvr.dll?UL=1&ACT=4&BUILD=6254&STRMVER=4&CAPREQ=0 HTTP/1.1" 404
  212.204.78.162 - - [27/Nov/2005:16:48:04 +0100] "GET
    /MSOffice/cltreq.asp?UL=1&ACT=4&BUILD=6254&STRMVER=4&CAPREQ=0 HTTP/1.1" 404
  218.89.167.126 - - [28/Nov/2005:11:20:12 +0100] "GET /sumthin HTTP/1.0"

What I envision is a new [ATTACK] keyword/section in the config file:

[ATTACK]
# Option:  enabled
# Notes.:  enable monitoring for this section.
# Values:  [true | false]  Default:  false
#
enabled = true

# Option:  logfile
# Notes.:  logfile to monitor.
# Values:  FILE  Default:  /var/log/httpd/access_log
#
logfile = /var/log/httpd/access_log

# Option:  attackfile
# Notes.:  file containing attacks to block
# Values:  FILE  Default:  /etc/fail2ban.dat
#
attackfile = /etc/fail2ban.dat

(rest of config to enable blocking/unblocking etc.)


The attack matching and blocking file would based on the above logfile
entries could be:

^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* - - \[.\*] "CONNECT
.* - - .* "GET /_vti_bin/
GET /MSOffice
/sumthin HTTP


With the external file read in and parse ability fail2ban would be
a very powerful tool and could be used to block numerous types of 
bad activity.

Regards

Iain

-- 
+49-172-8196039    Skype: iain.lea