Ask HN: How do you continuously monitor web logs for hack attempts?

Re:Ask HN: How do you continuously monitor web logs for hack... by semanticist on Monday May 07, 2018 @09:55PM (#17018226)

While it monitors SSH by default out of the box, people here are talking about creating custom filters which will monitor their Apache or Nginx logs. (Although, that said, we also have it monitor our non-standard SSH port with v. aggressive blocking rules, even though it's also behind a firewall. Defence in depth, and all that.)

The documentation isn't the greatest, but this page explains the concepts well enough and was easy to find using Google.

https://www.fail2ban.org/wiki/index.php/MANUAL_0_8

[ Parent | on HN ]

Re:Ask HN: How do you continuously monitor web logs for hack... by tbrock on Monday May 07, 2018 @10:30PM (#17018363)

I understand the concepts but... how do you actually use it?

[ Parent | on HN ]

Re:Ask HN: How do you continuously monitor web logs for hack... by semanticist on Tuesday May 08, 2018 @09:51PM (#17026884)

A filter matches lines in the nginx log using regular expressions. If the line matches, it uses another regexp to extract the IP address, and then calls out to scripts to block that IP address.

I'm not going to post the exact configuration files I use, but the GitHub repo for fail2ban contains examples.

https://github.com/fail2ban/fail2ban/blob/0.11/config/filter...

That's a filter that protects Apache against the 'shellshock' (https://en.wikipedia.org/wiki/Shellshock_(software_bug)) vulnerability, for example.

[ Parent | on HN ]

Re:Ask HN: How do you continuously monitor web logs for hack... by hluska on Monday May 07, 2018 @10:58PM (#17018489)

I like Fail2Ban, but as I remember it, my learning process looked a lot like this:

1.) Read through the documentation.

2.) Pour myself a scotch.

3.) Read through more documentation.

4.) Start drinking right out of the bottle.

5.) Try something.

6.) Get an error or experience a spectacular failure.

7.) Use StackOverflow.

8.) GOTO 5.

-------------

In good news, it worked - the light went on and now I'm confident that I could adapt Fail2Ban to suit any use. But, in bad news, honestly, I feel your pain and understand where/why you are getting stuck. Fail2Ban is a very complicated, yet extremely useful piece of software.

[ Parent | on HN ]

Re:Ask HN: How do you continuously monitor web logs for hack... by comboy on Tuesday May 08, 2018 @06:01AM (#17019882)

cd /etc/fail2ban and explore, you have example configs for all popular software and plenty of explanations in their comments

[ Parent | on HN ]