Quantcast
Channel: User BlaM - Server Fault
Viewing all articles
Browse latest Browse all 33

fail2ban rule results in "iptables returned 200" error message

$
0
0

I just tried to add a new fail2ban rule that is supposed to scan Apache2 error logs for suspicious file access attempts (People who try to access three common login urls that do not exist usually don't have good intentions).

To do so I added a new rule to my jail.local file:

[apache-suspiciousfiles]enabled   = trueport      = http,httpsfilter    = apache-suspiciousfilesbanaction = iptables-allportsaction    = %(action_mwl)slogpath   = /var/log/apache2/error*.logmaxretry  = 3

That - however - gave me an unexpected error message in my logs:

2014-02-10 13:28:51,450 fail2ban.jail   : INFO   Jail 'apache-suspiciousfiles' started2014-02-10 13:28:51,690 fail2ban.actions.action: ERROR  iptables -N fail2ban-apache-suspiciousfilesiptables -A fail2ban-apache-suspiciousfiles -j RETURNiptables -I INPUT -p tcp -j fail2ban-apache-suspiciousfiles returned 200

I had checked the filter with fail2ban-regex before that, so I was quite sure that it was not something in there.

(Note: This is "returned 200". Many people seem to have a problem with 100, but this is about 200)


Viewing all articles
Browse latest Browse all 33

Trending Articles