Fail2ban not banning attempted sql injection

Question

I'm getting a large number of sql injection attempts that all look alike on a daily basis. A snippet from the access logs shows:

8222 24.247.182.172 - - [09/Nov/2018:08:47:25 -0600] ***************.com "GET /Add_Product.php?strPhotoID=VA1209&price_selected=2+union+select+0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526--&page_id=912 HTTP/1.1" 302 0 "https://www.***************.com/Add_Product.php?strPhotoID=VA1209&price_selected=2+union+select+0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526--&page_id=912" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "-"

This is the configuration in jail.local:

[sql-union-select-attack]
enabled = true
filter = sql-union-select-attack
logpath = /var/log/nginx/*access.log
port = 8221,8222,8231,8232
maxretry = 1
findtime = 10
bantime = -1
action = iptables-allports[name=sqlUnionSelect]

Here is the filter (sql-union-select-attack.conf):

#The SQL Injection attempt with "union+select+" in the URL
[Definition]
failregex = ^\d{4} <HOST> -.*\"(GET|POST).*/Add_Product.php.*union

Yet here I am, getting no bans as shown with

fail2ban-client status sql-union-select-attack

    root@web4:/etc/fail2ban# fail2ban-client status sql-union-select-attack
    Status for the jail: sql-union-select-attack
    |- Filter
    |  |- Currently failed: 0
    |  |- Total failed: 0
    |  `- File list:    /var/log/nginx/**************.access.log /var/log/nginx/access.log
    `- Actions
       |- Currently banned: 0
       |- Total banned: 0
       `- Banned IP list:

What is going on here? Is something incorrect with my jail.local configuration?

Edit

Thanks to Michael Hampton's answer, it appears to be working now. I have a bash script that lets me select a jail to get the status:

root@web4:/etc/fail2ban# get_jail_status 
http-get-dos
http-post-dos
magento-url
megaindex-crawler-spam
nginx-499
nginx-aspx-url
sql-directory-attempt
sql-union-select-attack
sshd
Please enter the jail you would like to check: 
sql-union-select-attack
Status for the jail: sql-union-select-attack
|- Filter
|  |- Currently failed: 0
|  |- Total failed: 2
|  `- File list:    /var/log/nginx/**************.access.log /var/log/nginx/access.log
`- Actions
   |- Currently banned: 5
   |- Total banned: 5
   `- Banned IP list:   142.163.212.50 217.61.108.219 37.59.8.29 207.228.228.8 162.144.126.204

If I select one of those IP addresses and check it in iptables, it appears:

root@web4:/etc/fail2ban# iptables -L -v -n | grep 142.163.212.50
0     0 REJECT     all  --  *      *       142.163.212.50       0.0.0.0/0            reject-with icmp-port-unreachable

So it appears to be working!

Check your jail.conf and see what the default `backend` is set to? — Michael Hampton, Nov 09 '18 at 15:24
Make sure you have pyinotify installed, then, or reinstall it, e.g.: `sudo apt-get install --reinstall python-pyinotify` — Michael Hampton, Nov 09 '18 at 15:35
It was not installed. Just installed it. Should I restart the fail2ban-client? — DevOpsSauce, Nov 09 '18 at 15:36
Yes, you'll need to restart fail2ban. It can't read log files (other than the systemd journal) without pyinotify. — Michael Hampton, Nov 09 '18 at 15:40

score 2 · Accepted Answer · answered Nov 09 '18 at 15:41

2

Fail2ban needs to have pyinotify installed to read log files other than via the systemd journal. If it isn't installed, then you should install or reinstall it. For example:

sudo apt-get install python-pyinotify

After that, restart fail2ban and wait a few minutes for it to chew through the existing log files.

(Technically it can also use gamin, but historically that hasn't been very reliable...)

answered Nov 09 '18 at 15:41

Michael Hampton

237,123
42
477
940

Edited my question to show that your answer worked. Thank you! – DevOpsSauce Nov 09 '18 at 15:48

Fail2ban not banning attempted sql injection

1 Answers1