From e1bc94ff7a1970c8bc669a034ffbf7d0165e510a Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Sun, 3 Dec 2023 20:20:43 +0000 Subject: [PATCH] Use fail2ban to block bogus note searches --- cookbooks/web/recipes/frontend.rb | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/cookbooks/web/recipes/frontend.rb b/cookbooks/web/recipes/frontend.rb index 44aa0cd5b..6c1f0f761 100644 --- a/cookbooks/web/recipes/frontend.rb +++ b/cookbooks/web/recipes/frontend.rb @@ -75,6 +75,16 @@ fail2ban_jail "apache-request-timeout" do ports [80, 443] end +fail2ban_filter "apache-notes-search" do + failregex '^ .* "GET /api/0\.6/notes/search\?q=abcde&.*$' +end + +fail2ban_jail "apache-notes-search" do + filter "apache-notes-search" + logpath "/var/log/apache2/access.log" + ports [80, 443] +end + if %w[database_offline database_readonly].include?(node[:web][:status]) service "rails-jobs@mailers" do action :stop -- 2.39.5