From 4d0f0d5a2c8841d2e7e4553f359bc3322512e6e8 Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Sun, 3 Dec 2023 20:20:21 +0000 Subject: [PATCH] Use fail2ban to block hosts with repeated request timeouts --- cookbooks/web/metadata.rb | 1 + cookbooks/web/recipes/frontend.rb | 11 +++++++++++ 2 files changed, 12 insertions(+) diff --git a/cookbooks/web/metadata.rb b/cookbooks/web/metadata.rb index fc262fd5e..a0e3e8779 100644 --- a/cookbooks/web/metadata.rb +++ b/cookbooks/web/metadata.rb @@ -10,6 +10,7 @@ depends "accounts" depends "apache" depends "apt" depends "chef" +depends "fail2ban" depends "geoipupdate" depends "git" depends "memcached" diff --git a/cookbooks/web/recipes/frontend.rb b/cookbooks/web/recipes/frontend.rb index f27b029c9..44aa0cd5b 100644 --- a/cookbooks/web/recipes/frontend.rb +++ b/cookbooks/web/recipes/frontend.rb @@ -21,6 +21,7 @@ node.default[:memcached][:ip_address] = node.internal_ipaddress || "127.0.0.1" include_recipe "memcached" include_recipe "apache" +include_recipe "fail2ban" include_recipe "web::rails" include_recipe "web::cgimap" @@ -64,6 +65,16 @@ template "/etc/logrotate.d/apache2" do mode "644" end +fail2ban_filter "apache-request-timeout" do + failregex '^ .* "-" 408 .*$' +end + +fail2ban_jail "apache-request-timeout" do + filter "apache-request-timeout" + logpath "/var/log/apache2/access.log" + ports [80, 443] +end + if %w[database_offline database_readonly].include?(node[:web][:status]) service "rails-jobs@mailers" do action :stop -- 2.39.5