Ok so here is a quick post to a common question… adding a filter to fail2ban for bot/scanners searching for files, folders or simply doing recon which can result in exploit discovery, this filter will automatically block a visitor/bot after 4 attempts to scan for a file that does not exist on your domain/server.
like always… BASH IN! (lol…)
sudo bash
First Lets create a new entry in our jail.local file…
vim /etc/fail2ban/jail.local
copy the following text after the last apache entry…
[apache-nofile] enabled = true port = http,https filter = apache-nofile logpath = /var/log/apache*/*error.log maxretry = 4
Now that we have added the entry into our jail.local we proceed, change to the filter.d directory, in this folder you will see lots of other pre-configured filters
cd /etc/fail2ban/filter.d
instead of creating a new filter file simply copy another, this will make the next step easier…
cp /etc/fail2ban/filter.d/apache-auth.conf /etc/fail2ban/filter.d/apache-nofile.conf
find the line identical to the one below (Line 23)
failregex = ^%(_apache_error_client)s user .* (authentication failure|not found|password mismatch)\s*$
replace it with the following one.
failregex = [[]client <HOST>[]] File does not exist:
At this point your pretty much done, close the file and restart fail2ban
service fail2ban restart
Comment if you have questions, like my post if you find it helpful :)
