当从另一台服务器测试我的应用程序时fail2ban
,我看到以下日志:
2021-08-01 18:48:37,692 fail2ban.filter [1]: INFO [nginx] Found 51.195.221.70 - 2021-08-01 18:48:37
2021-08-01 18:48:37,897 fail2ban.filter [1]: INFO [nginx] Found 51.195.221.70 - 2021-08-01 18:48:37
2021-08-01 18:48:38,496 fail2ban.filter [1]: INFO [nginx] Found 51.195.221.70 - 2021-08-01 18:48:38
2021-08-01 18:48:38,671 fail2ban.filter [1]: INFO [nginx] Found 51.195.221.70 - 2021-08-01 18:48:38
2021-08-01 18:48:38,860 fail2ban.filter [1]: INFO [nginx] Found 51.195.221.70 - 2021-08-01 18:48:38
2021-08-01 18:48:38,976 fail2ban.actions [1]: NOTICE [nginx] Ban 51.195.221.70
2021-08-01 18:48:39,234 fail2ban.filter [1]: INFO [nginx] Found 51.195.221.70 - 2021-08-01 18:48:39
[SNIP]
2021-08-01 18:48:41,686 fail2ban.filter [1]: INFO [nginx] Found 51.195.221.70 - 2021-08-01 18:48:41
2021-08-01 18:48:41,872 fail2ban.filter [1]: INFO [nginx] Found 51.195.221.70 - 2021-08-01 18:48:41
2021-08-01 18:48:41,897 fail2ban.actions [1]: NOTICE [nginx] 51.195.221.70 already banned
即使被发现并被禁止,请求仍可继续。我的 Docker 容器如下所示:
fail2ban:
image: 'crazymax/fail2ban:latest'
restart: 'always'
network_mode: 'host'
cap_add:
- 'NET_ADMIN'
- 'NET_RAW'
volumes:
- 'nginx-log:/var/log:ro'
- 'fail2ban-data:/data'
env_file:
- './fail2ban.env'
我的配置是:
jail.d/nginx.conf
[nginx]
enabled = true
logpath = /var/log/access.log
port = http,https
过滤器.d/nginx.conf
[Definition]
failregex = ^<HOST> \- \S+ \[\] \"(GET|POST|HEAD) .+\" 419 .+$
ignoreregex =
任何帮助都值得感激。我需要配置 IP 表吗?
答案1
https://github.com/crazy-max/docker-fail2ban/blob/master/examples/jails/traefik/jail.d/traefik.conf
我发现我需要添加chain = DOCKER-USER
一些内容jail.d/nginx.conf
才能使其工作。