fail2ban 크롤링 필터

---------------- vi /etc/fail2ban/filter.d/ㅌㅌㅌㅌㅌ-crawler.conf ------------

 

[Definition]

failregex = ^<HOST> .*"(GET|POST|HEAD) /(aaa/content/|aaa/list(?:\?| )|board/content/|board/list/)[^ ]* HTTP/[^"]*" (200|301|302)  <-- (aaa/content/|aaa/list(?:\?| )  list/ 와 list/? 뒤에 붙는 것도 선별

ignoreregex =

 

----------------------------------------- 여기까지 저장

 

 

------------  vi /etc/fail2ban/jail.local ------------

 

 

[DEFAULT]
ignoreip = 127.0.0.1/8 111.222.333.444 <-- 아이피 추가
bantime = -1
findtime = 600
maxretry = 3
banaction = firewallcmd-rich-rules

[sshd]
enabled = true
port = sshd 포트
logpath = /var/log/secure

[vsftpd]
enabled = true
port = ftp 포트
logpath = /var/log/vsftpd.log

[ㅌㅌㅌㅌㅌㅌ-crawler]
enabled = true
filter = ㅌㅌㅌㅌㅌ-crawler
logpath = /var/log/nginx/access.log tail
maxretry = 20
findtime = 15
bantime = 86400

 

----------------------------------------

 

fail2ban-client -t

sudo systemctl restart fail2ban