fail2ban custom filter

gistapo

Is it possible to create a custom filter for the aaPanel fail2ban plugin except for the one provided in the dropbox menu? I would like to catch and ban different scan bots that are looking for WordPress vulnerabilities, nonexistent files, etc.

aaPanel_Kern

Hello,
Currently, there is no such thing. Fail2ban can only intercept based on the IP number.
It is recommended that you use Nginx waf

gistapo

aaPanel_Kern Ok, in my case it would be Apache WAF then. Another question: when I create a new filter in the Fail2ban plugin of aaPanel, where are the jail* and *.conf filter files located? I would like to investigate the action of these filters. It looks like this rule never really blocks IP that has been caught and added to the ban list.

aaPanel_Kern

gistapo
Hello.
You can check this file

/etc/fail2ban/jail.local

gistapo

aaPanel_Kern

1) Please see below the aaPanel plugins logs, Mail Server, and Fail2Ban. You can see that IP address 213.209.157.121 is caught by Fail2Ban and added to the ban list. But in the Mail Server log connections are still incoming when they should be dropped.

2) Every time I do an edit filter and press save, your Fail2Ban plugin adds an additional new line before and after the filter in the /etc/fail2ban/jail.local file. If I edit 5 times, 5 new lines have been added before and after sshd, for example. See the attached image below.

aaPanel_Kern

Hello,
Please check whether this IP is blocked in the system firewall?
The problem of blank lines is added when adding or editing.

gistapo

aaPanel_Kern

1) IP is not in being added to firewall block list.

2) Blank line is added when editing.

aaPanel_Kern

Hi, can you give us your aapanel information? The server makes a snapshot backup first, if possible, please send it to kern@aapanel.com.
It is recommended to fill in the following
Post link:
SSH IP address, account password and port:
aaPanel login link address and account password:
Detailed problem description:

No post link will not be able to know which user's information is, and the problem will not be processed

gistapo