How to prevent 404 attacks in Apache Web server using fail2ban?
404 attacks are a good option for hackers. they use this as a DDoS tool. Fail2ban helps to prevent that attacks.
Fail2ban frequently checks apache2 logs and detects 404 HTTP request codes based on regex conditions. Fail2ban block those IP for some time to prevent them from attacking the server.
Let’s start to prevent 404 attacks in the Apache Web server using Fail2ban
Prerequisites
– Ubuntu 18.04 with SSH access.
( Currently, I’m using this Ubuntu 18.04 version for testing )
Update your package for Ubuntu & Installing Fail2ban in Ubuntu.
sudo apt-get update sudo apt-get install fail2ban
Now, We have to create a custom jail local file to prevent 404 attacks in the apache web server.
Let’s set up Fail2ban to detect Apache 404 attacks.
1. Create a filter
2. Create a custom jail
3. Verify Fail2ban status
4. Verify Fail2ban Apache 404 attacks.
/etc/fail2ban/filter.d
We have to monitor Apache 404 errors. So create a server with prevent-apache-404.conf at the location of /etc/fail2ban/filter.d
failregex = ^.*"(GET|POST|HEAD).*" (404|444|403|400) .*$ ignoreregex =
sudo nano /etc/fail2ban/jail.local
[prevent-apache-404] enabled = true port = http,https filter = prevent-apache-404 logpath = /var/log/apache*/*access.log findtime = 600 maxretry = 4
sudo service fail2ban stop sudo service fail2ban start sudo service fail2ban status sudo fail2ban-client status sudo fail2ban-client status prevent-apache-404
Status for the jail: prevent-apache-404 |- Filter | |- Currently failed: 0 | |- Total failed: 80 | `- File list: /var/log/apache2/other_vhosts_access.log `- Actions |- Currently banned: 1 |- Total banned: 9 `- Banned IP list: xxx.xxx.xxx.xxx
iptables -nL
sudo nano /var/log/fail2ban.log
Bingo, now you are safe using Fail2ban from 404 attacks in the Apache Web server.
I hope you like this article. Keep visiting my website for more upcoming articles. If you need any help with How to prevent 404 attacks in the Apache Web server using fail2ban? you can contact me. You can ask me questions in the comments also. You can connect me on social media as well as links are below in the footer section. Keep connected. Happy Coding.
