Ubuntu-fr

creatiel

fail2ban accès phpMyAdmin

Bonjour à tous,

Existe-t-il un moyen de paramétrer fail2ban pour bannir ce genre de tentative :

[Wed May 14 01:07:04 2014] [error] [client 220.226.205.181] File does not exist: /var/www/muieblackcat
[Wed May 14 01:07:04 2014] [error] [client 220.226.205.181] File does not exist: /var/www/phpAdmin
[Wed May 14 01:07:05 2014] [error] [client 220.226.205.181] File does not exist: /var/www/phpMyAdmin
[Wed May 14 01:07:05 2014] [error] [client 220.226.205.181] File does not exist: /usr/share/phpmyadmin/scripts
[Wed May 14 01:07:05 2014] [error] [client 220.226.205.181] File does not exist: /var/www/mysql
[Wed May 14 01:07:05 2014] [error] [client 220.226.205.181] File does not exist: /var/www/mysqladmin
[Wed May 14 01:07:06 2014] [error] [client 220.226.205.181] File does not exist: /var/www/myadmin
[Wed May 14 01:07:06 2014] [error] [client 220.226.205.181] File does not exist: /var/www/mysqladmin

J'en trouve beaucoup dans les logs ...

Merci .
;-) G.

Pseudo supprimé

Re : fail2ban accès phpMyAdmin

salut

grep -ri "File does not exist" /etc/fail2ban/filter.d
/etc/fail2ban/filter.d/apache-noscript.conf:failregex = [[]client <HOST>[]] File does not exist(.*)
/etc/fail2ban/filter.d/apache-nohome.conf:failregex = [[]client <HOST>[]] File does not exist: .*/~.*
/etc/fail2ban/filter.d/apache-phpmyadmin.conf:##old failregex = [[]client <HOST>[]] File does not exist: %(docroot)s/(?:%(badadmin)s)
/etc/fail2ban/filter.d/apache-phpmyadmin.conf:failregex = [[]client <HOST>[]] File does not exist: .*(PMA|phpmyadmin|php-my-admin|phpMyAdmin|myadmin|mysql|mysqladmin|sqladmin|mypma|xampp|mysqldb|mydb|db|pmadb|phpmyadmin1|myadmin2|admin|db|dbadmin|websql|roundcube|piwigo|wordpress)

ton log ressemble au dernier filtre
---
vérification

sudo  fail2ban-regex  /var/log/.../target.log /etc/fail2ban/filter.d/apache-phpmyadmin.conf

et si c'est bon tu as plus qu'à l'inclure dans /etc/fail2ban/jail.local

creatiel

Re : fail2ban accès phpMyAdmin

Merci de ta réponse.

J'ai ajouté 2 filtres  : apache-bruteforce et apache-Vhost
préconisés dans ce sujet :
http://forum.ubuntu-fr.org/viewtopic.php?id=800421