{"id":67,"date":"2012-09-03T21:06:08","date_gmt":"2012-09-03T20:06:08","guid":{"rendered":"http:\/\/blog.beufa.net\/?p=67"},"modified":"2012-09-03T21:06:08","modified_gmt":"2012-09-03T20:06:08","slug":"fail2ban-bloquer-les-requetes-w00tw00t-et-phpmyadmin","status":"publish","type":"post","link":"https:\/\/beufa.net\/fr\/blog\/fail2ban-bloquer-les-requetes-w00tw00t-et-phpmyadmin\/","title":{"rendered":"Fail2Ban : bloquer les requ\u00eates w00tw00t et phpMyAdmin"},"content":{"rendered":"

Parce que j’en avais marre de tous ces scanners DFind et autres sur mes serveurs home et OVH, j’ai ajout\u00e9 deux regexp que je vous partage ici pour bloquer apr\u00e8s la premi\u00e8re requ\u00eate les acc\u00e8s aux URI :<\/p>\n

\/w00tw00t.at.ISC.SANS.DFind<\/p>\n

\/phpMyAdmin<\/p>\n

Pour cela, il faut cr\u00e9er deux nouveaux fichiers dans la configuration fail2ban :<\/p>\n

[user@srv:~]$ cat \/etc\/fail2ban\/filter.d\/apache-w00tw00t.conf \n[Definition]\n\nfailregex = ^<HOST> -.*\"GET \/w00tw00t.at.ISC.SANS.DFind:).*\".*\n\nignoreregex =\n\n[user@srv:~]$ cat \/etc\/fail2ban\/filter.d\/apache-pma.conf \n[Definition]\n\nfailregex = ^<HOST>.*GET.*(?i)phpmyadmin.*\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ^<HOST>.*GET.*(?i)pma.*\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ^<HOST>.*GET.*(?i)mysql.*\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ^<HOST>.*GET.*(?i)setup.*\n\nignoreregex =<\/pre>\n
Une fois ces 2 fichiers cr\u00e9\u00e9s, il faut \u00e9diter le fichier \/etc\/fail2ban\/jail.conf et y ajouter, \u00e0 votre convenance, les r\u00e9f\u00e9rences aux filtres nouvellement cr\u00e9\u00e9s :<\/p>\n
[apache-w00tw00t]\nenabled = true\nfilter = apache-w00tw00t\naction = iptables[name=Apache-w00tw00t,port=80,protocol=tcp]\n         sendmail-whois[name=Apache-w00tw00t, dest=user@mail.com, sender=srv@mail.com]\nlogpath = \/var\/log\/apache2\/*_access.log\nmaxretry = 1\n\n[apache-pma]\nenabled = true\nfilter = apache-pma\naction = iptables[name=Apache-pma,port=80,protocol=tcp]\n         sendmail-whois[name=Apache-pma, dest=user@mail.com, sender=srv@mail.com]\nlogpath = \/var\/log\/apache2\/*_access.log\nmaxretry = 1<\/pre>\n
D\u00e8s qu’une requ\u00eate contenant dans l’URI les regexp renseign\u00e9es dans les filtres plus haut, l’IP sera bannie et un mail sera envoy\u00e9 \u00e0 user@mail.com.<\/p>\n
Vous pouvez monitorer les hosts blacklist\u00e9s par munin ou par la commande iptables :<\/p>\n
[user@srv:~]$ sudo iptables -L fail2ban-Apache-pma --line-num \nChain fail2ban-Apache-pma (1 references)\nnum  target     prot opt source               destination         \n1    RETURN     all  --  anywhere             anywhere<\/pre>\n
Bye bye les scripts kiddies \ud83d\ude09<\/p>\n","protected":false},"excerpt":{"rendered":"
Parce que j’en avais marre de tous ces scanners DFind et autres sur mes serveurs home et OVH, j’ai ajout\u00e9 deux regexp que je vous…<\/p>\n
Continue readingFail2Ban : bloquer les requ\u00eates w00tw00t et phpMyAdmin<\/span><\/a><\/div>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,31,25,27],"tags":[44,47,54,68,79],"class_list":["post-67","post","type-post","status-publish","format-standard","hentry","category-linux","category-scanner","category-securite-2","category-webapps","tag-dfind","tag-fail2ban","tag-iptables","tag-phpmyadmin","tag-securite","entry"],"_links":{"self":[{"href":"https:\/\/beufa.net\/fr\/wp-json\/wp\/v2\/posts\/67","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/beufa.net\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/beufa.net\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/beufa.net\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/beufa.net\/fr\/wp-json\/wp\/v2\/comments?post=67"}],"version-history":[{"count":0,"href":"https:\/\/beufa.net\/fr\/wp-json\/wp\/v2\/posts\/67\/revisions"}],"wp:attachment":[{"href":"https:\/\/beufa.net\/fr\/wp-json\/wp\/v2\/media?parent=67"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/beufa.net\/fr\/wp-json\/wp\/v2\/categories?post=67"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/beufa.net\/fr\/wp-json\/wp\/v2\/tags?post=67"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}