Last-modified: 2014-10-16 (木) 02:12:34
スクリプト/nginx-shellshock.conf

概要

fail2banのNginx Shellshock用フィルタです。

フィルタ対象フォーマット

Everything is expanded.Everything is shortened.
  1
 
[27/Sep/2014:23:46:16 +0900],401,-,0.000,188,118.192.48.6,"GET /cgi-bin/count.cgi HTTP/1.1","() { :; }; echo Mozilla: `echo kUOm4N0953`;"

/etc/fail2ban/filter.d/nginx-shellshock.conf

Everything is expanded.Everything is shortened.
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
-
|
|
|
|
|
!
 
 
-
|
!
 
 
 
 
-
|
|
!
 
 
 
 
 
 
# Fail2Ban configuration file
#
# Author: paburica
#
# $Revision$
#
 
[INCLUDES]
 
# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf
 
 
[Definition]
 
# Option:  failregex
# Values:  TEXT
#
failregex = ^\[.*\],.+?,.+?,.+?,.+?,<HOST>,.+?,".*?\(.*?\).*?{.*$
 
# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

その他

  1. /etc/fail2ban/jail.local例
    Everything is expanded.Everything is shortened.
      1
      2
      3
      4
      5
      6
      7
      8
    
    -
    !
     
     
     
     
     
     
    
    # Nginx ShellShockをチェック
    [nginx-shellshock]
    enabled  = true
    filter   = nginx-shellshock
    logpath  = /opt/nginx/log/*/access.log
    port     = http,https
    bantime  = 3600
    maxretry = 1
  2. 反映
    Everything is expanded.Everything is shortened.
      1
      2
      3
      4
    
    -
    !
    -
    !
    
    # 確認
    fail2ban-regex <対象ログパス> /etc/fail2ban/filter.d/nginx-shellshock.conf
    # 反映
    service fail2ban restart

検証時の環境