Configure Fail2Ban With Mod Security And Other Filters

This guide better to said to be continuation of IPtables Basic 3 and installing Mod Security. In this guide we will discuss around how to configure Fail2Ban with Mod Security & some other filters on Apache server to protect from PHP and other exploits. We are taking it granted that, from new user you are now somewhat used with Fail2Ban.

 

Configure Fail2Ban With Mod Security Filter

 

If you have installed, configured Mod Security in our way (that is standard way), you need not to do anything with Mod Security part. SSH to your server, change directory to /etc/fail2ban/filter.d, create a file named modsec.conf :

Fill that modsec.conf with this content :

Save the file. Open /etc/fail2ban/jail.conf :

add this :

Restart Fail2Ban and check status :

Against the last command, I got this output after 30 minutes :

What exactly happens, when WordPress plugin like IP Geo Block blocks attempt and send error, Mod Security catches it! Fail2Ban filter bans it! So, once try towards wp-login means banned as IP Geo Block sent 403 error from your settings, and Mod Security caught it. Next time WordPress and PHP need not to handle the load, from iptables the moron will be denied.

 

Configure Fail2Ban With Mod Security Filter Plus Other Filters

 

You can add more filters which are bundled inside /etc/fail2ban/filter.d. Open /etc/fail2ban/jail.conf :

add this :

Restart Fail2Ban and check status :

You can cat the fail2ban log file to check any error :

I was getting an error :

I have fixed that in this guide’s settings. We can test filter in this way :

Run this for fine tuning (optional, for the advanced users) :

What those jails do?

apache = detects, blocks password authentication failures
apache-noscript = detects, blocks potential search for exploits, php vulnerabilities
apache-overflows = detects, blocks Apache overflow attempts
apache-nohome = detects, blocks failures to find a home directory on a server
apache-badbots = detects, blocks bad bots
php-url-fopen = detects, blocks attempts to use certain PHP behavior for malicious purposes