Over the past week, I had my Friendica instance hammered by login attempts and bad bots.
This is the process I used to track down the culprits, configure Fail2Ban, and set up email reports so I can keep an eye on what's happening without having to live in the logs for hours on end every day.
If you break it, you get to keep all the pieces.
I started by looking at the Apache access logs and live connections to see where the noise was coming from:
sudo awk '{print $1}' /var/log/apache2/access.log | sort | uniq -c | sort -nr | head
sudo ss -tn sport = :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head
sudo ss -tn sport = :443 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head
This quickly showed me that entire ranges (8.217.x.x and 8.218.x.x) were a problem. These turned out to be Alibaba in China. I had no idea they did VPS. I thought they were retail merchants.
I blocked them both at the firewall level:
sudo ufw deny from 8.217.0.0/16
sudo ufw deny from 8.218.0.0/16
sudo iptables -A INPUT -s 8.217.0.0/16 -j DROP
sudo iptables -A INPUT -s 8.218.0.0/16 -j DROP
With the worst of the noise blocked, I now had a semi-working system and set about installing Fail2Ban:
sudo apt update
sudo apt install fail2ban
I edited the local jail configuration:
sudo vim /etc/fail2ban/jail.local
Here’s the setup that worked for me:
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 MY IP
bantime = 3600
findtime = 600
maxretry = 5
[apache-badbots]
enabled = true
port = http,https
filter = apache-badbots
logpath = /var/log/apache2/access.log
maxretry = 3
[apache-noscript]
enabled = true
port = http,https
filter = apache-noscript
logpath = /var/log/apache2/access.log
maxretry = 3
[friendica]
enabled = true
filter = friendica
logpath = /var/log/friendica.log
maxretry = 5
bantime = 3600
Friendica doesn't log failed logins in the same way as many other applications. Instead of giving a straight 401 or 403, it responds with a redirect:
POST /login HTTP/1.1" 302
So a failed login attempt shows up in the Apache access log as a POST /login followed by a 302 redirect back to /login. That’s the pattern I used for my Fail2Ban filter:
sudo vim /etc/fail2ban/filter.d/friendica.conf
[Definition]
failregex = ^ -.* "POST /login HTTP/1\.1" 302 [0-9]+ "https?://.*?/login"
ignoreregex = ^ -.* "POST /login HTTP/1\.1" 302
And then I added a specific jail for it:
[friendica-login]
enabled = true
port = http,https
filter = friendica-login
logpath = /var/log/apache2/access.log
maxretry = 3
findtime = 600
bantime = 3600
ignoreip = 127.0.0.1/8 192.168.0.0/16
Once the configs were in place I restarted Fail2Ban and checked the status:
sudo systemctl restart fail2ban
sudo fail2ban-client status
sudo fail2ban-client status apache-abuse
I installed sendmail so the server could email me reports:
sudo apt install sendmailThen I created a small cron job to email me the status and last bans every three days:
sudo vim /etc/cron.d/f2b-report
# Fail2Ban status report every 3 days
0 9 */3 * * root (echo "Fail2Ban Status"; /usr/local/bin/f2bstatus; echo; echo "Recent Bans"; /usr/local/bin/f2bstatus recent) | sendmail you
I've got Fail2Ban handling bad bots, Friendica logins being monitored properly, and an email in my inbox every three days reminding me which IPs have been thrown out. It took a fair amount of trial and error to arrive at this point, but this is the working configuration, and my instance is a lot happier.
My actual name is Pete. This is why I have the username
This work is licensed under a Creative Commons Attribution 4.0 International License.
License explained: Examples
Create your license: Choose Yours
FOSS, Linux & Creative Commons Advocate.
"Don’t dim your light to fit in with the shadows — shine boldly. The right people will warm to your glow, and the rest were never meant to see you clearly. And when I speak, don’t read what you think I meant; read what I wrote — because my truth isn’t up for interpretation."