Security fail2ban for Centmin Mod + CSF Firewall / Cloudflare API

Yes that will help !

But i think if it is possible to have separate logs for server ip and hostname will be the best solution.....

Having both in one log file is useless for Cloudflare users.....

 

Ok so if a user attack the server ip it will be logged at:

and a csf ban will do the job !

But if user attack the hostname like server.mydomain.com then it will be logged on the same path:

and the ban to csf will not help as that is passing through Cloudflare and is better to ban there....

Sorry for the confusion...

 

Nope that's not the best solution as the problem is not only the action it is also the logpath.

What I mean is that is pointless if I use logpath /var/log/nginx/ to get a Cloudflare ban .....

 

Ok thanks

I will do more tests tonight and I will post back

 

Ok so final thoughts

For non Cloudflare users all are ok !

For banning users that attacking the domain e.x:

Code:

www.mydomain.com

all are ok by using the path:

Code:

/home/nginx/domains/*/log/access.log

For the hostname i didn't get any logs ?

Checking using:

Code:

siege -b -c1 -r500 https://server.mydomain.com/15080_mysqladmin1212/index.php

I thought that should logged at:

or

Don't know why.... ?

The same for the server ip also using:

Code:

siege -b -c1 -r500 123.456.789.000

By checking at:

and

All above tests was with fail2ban disabled and Cloudflare enabled just to see the entries in the log files....

So if i get the server ip attacks at the:

and

and the hostname attacks at:

or

Then all is ok !

But if i will get mixed ip attacks and hostname attacks on the same log files then maybe the only solution is to use two actions so i can block them on both places......

Wondering why i can't see anything on that logs....?

 

Yes!

 

Don't know how but after x minutes the entries was on the file

Don't know why i got that delay....

Code:

/usr/local/nginx/conf/conf.d/virtual.conf

that's what i have there:

Code:

        access_log              /var/log/nginx/localhost.access.log;
        error_log               /var/log/nginx/localhost.error.log      error;

 

Also i think that should be enabled as default

Already found a related entry on my logs

 

Also at the domain logs should i use:

Code:

access_log /home/nginx/domains/mydomain.com/log/access.log combined;

or

Code:

access_log /home/nginx/domains/mydomain.com/log/access.log;

?

 

I think that you confused and that reply is for:

https://community.centminmod.com/th...and-error_log-directives-in-nginx-conf.12810/

?

As for fail2ban access.log file must be enabled...

 

What about:

enabled as default?