Security fail2ban for Centmin Mod + CSF Firewall / Cloudflare API

One last question:

Code:

[nginx-req-limit]
enabled = true
filter = nginx-req-limit
action = csfdeny[name=nginx-req-limit]
#action   = cloudflare
logpath = /home/nginx/domains/*/log/error.log
findtime = 600
bantime = 7200
maxretry = 5


[nginx-conn-limit]
enabled = true
filter = nginx-conn-limit
action = csfdeny[name=nginx-conn-limit]
#action   = cloudflare
logpath = /home/nginx/domains/*/log/error.log
findtime = 600
bantime = 7200
maxretry = 5

Isn't better to add also the other two error paths on the above?

Code:

/usr/local/nginx/logs/*access.log
/var/log/nginx/*.access.log

or they may cause any issues?

 

And this one also:

Code:

[phpmyadmin-cmm]
enabled = false
filter = phpmyadmin-cmm
action = csfdeny[name=phpmyadmin-cmm]
#action = cloudflare
logpath = /var/log/nginx/localhost_ssl.access.log
/var/log/nginx/*.access.log
port = http,https
bantime = 3600
maxretry = 5
findtime = 60

change to:

Code:

[phpmyadmin-cmm]
enabled = false
filter = phpmyadmin-cmm
action = csfdeny[name=phpmyadmin-cmm]
#action = cloudflare
logpath = /var/log/nginx/*.access.log
port = http,https
bantime = 3600
maxretry = 5
findtime = 60

and this one:

Code:

[shells]
enabled = true
filter = shells
action = csfdeny[name=shells]
#action   = cloudflare
logpath = /home/nginx/domains/*/log/access.log
          /usr/local/nginx/logs/access.log
          /var/log/nginx/localhost_ssl.access.log
          /var/log/nginx/*.access.log
bantime = 604800
maxretry = 1
findtime = 86400

change to:

Code:

[shells]
enabled = true
filter = shells
action = csfdeny[name=shells]
#action   = cloudflare
logpath = /home/nginx/domains/*/log/access.log
          /usr/local/nginx/logs/access.log
          /var/log/nginx/*.access.log
bantime = 604800
maxretry = 1
findtime = 86400

Thank you George !

 

Great thank you

 

The only negative after testing it for a few days is the scenario:

I use connections limit 20 and a user get banned ...

Then I want to increase that limit to 30 and after doing that and after unban the user it will be banned again as the fail2ban will detect the related previous error log entry :-(

So every time I will need to clear the related logs....

Other than that it works great and it can help a lot !

 

Is it possible to add some magic on your code?

If i use Cloudflare and a user get banned by a detection from a log file like:

then the Cloudflare ban will not affect him as the logs there are for access to the ip and not domain :-(

Then if i set it to use csf it may detect it at the domains log file so it will not affect it again.

An easy way to fix this is to duplicate the rules and for domains logs to use cloudflare and the duplicated rule will check only the log files ouside of the domains logs so it can ban at the csf ....

 

I think it can't be automated....

But do you think is better to just duplicate the rule in jail.conf and just point the action to Cloudflare and log to check at the domain level and then at the duplicated rule action csf and point to logs outside of domains log?

Or is it better to duplicate also the filter like nginx-limit.conf and nginx-limit2.conf and create a second rule for that?

 

Let me explain a practical scenario

Logs for domain:

Code:

/home/nginx/domains/mydomain.com/log/error.log
/usr/local/nginx/logs/error.log

So the above have user entries using the domain like:

Logs for the server ip:

Code:

/var/log/nginx/localhost.error.log

So the above have user entries using the server ip:

Now let's say that we have:

Code:

[nginx-req-limit-main]
enabled = true
filter = nginx-req-limit
#action = csfdeny[name=nginx-req-limit-main]
action   = cloudflare
logpath = /usr/local/nginx/logs/error.log
          /var/log/nginx/*.error.log
findtime = 600
bantime = 7200
maxretry = 5

So if i use Cloudflare and that rule find a user that must be ban at:

Code:

/usr/local/nginx/logs/error.log

Then great the user will not be able to browse again the site and that's how it should be

But if a user found that must be ban at:

Code:

/var/log/nginx/*.error.log

(accessing the ip of the server or try to hit there)

then the ban at Cloudflare will not affect him and he will be able to continue accessing directly the server ip

 

A simple solution is to duplicate the rule like (if it's allowed):

Code:

[nginx-req-limit-main]
enabled = true
filter = nginx-req-limit
#action = csfdeny[name=nginx-req-limit-main]
action   = cloudflare
logpath = /home/nginx/domains/*/log/error.log
               /usr/local/nginx/logs/error.log
findtime = 600
bantime = 7200
maxretry = 5

and

Code:

[nginx-req-limit-main]
enabled = true
filter = nginx-req-limit
action = csfdeny[name=nginx-req-limit-main]
#action   = cloudflare
logpath = /var/log/nginx/*.error.log
findtime = 600
bantime = 7200
maxretry = 5

Don't know if that's ok or best way to do it.....but with the above if a user use the domain to hit it will get banned on the Cloudflare and if he use the ip it will be banned to the csf !

Or just create two filters and two rules with one to scan the error log file with ip's and use csf as action and the other to scan the error log file with domain entries and use the Cloudflare action method...

or am i missing something?

What do you think George?

 

Ok so we have domains logs at:

and the logs for direct ip connections at:

?

What I try to figure is which log has attacks to domain so I can set action to Cloudflare and which log has attacks to ip so I can set action to csf ....

Thank you

 

I thought that was for logs from:

or not?

As that's a place someone can attack....?

If not then please remove all related entries from jail.local

Thank you

 

The perfect scenario for fail2ban will be:

One place for log files for domains logs and that is ok now !(ban to Cloudflare)

One place for logs for direct access to ip.(ban to csf)

One place for logs for hostname access.(ban to Cloudflare)

Thank you

 

Does your like means that you can do that adjustment?