This package includes a script and fail2ban configuration that allows you to use fail2ban when utilizing AWS elastic load balancer (ELB) and an apache webserver. It is useful to protect your site against DoS and brute force attacks when behind a reverse proxy load balancer like ELB. Special consideration is required when using ELB with fail2ban because ELB only forwards the client IP to the server in an X-Forwarded-For header. Following this guide will enable you to use ELB, Apache webservers and AWS ACL together with fail2ban for an dynamic firewall solution.
composer require anthonymartin/aws_acl_fail2ban
- alternatively, you can clone or download this repository.Enable RemoteIP mod
Update apache configuration - the configuration below is what my configuration found at /etc/apache2/apache2.conf looks like. Be sure to include RemoteIPHeader and replace LogFormat with the lines found below.
RemoteIPHeader X-Forwarded-For
LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %O" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
run sudo service apache2 reload
fail2ban/action.d/aws-acl.conf
in /etc/fail2ban/action.d/
directoryfail2ban/filter.d/aws-acl-example-filter.conf
to /etc/fail2ban/filter.d/
directoryactionban
and actionunban
definitions in /etc/fail2ban/action.d/aws-acl.conf
. You need tos replace both instances of /path/to/aws-acl-fail2ban
to the location of aws-acl-fail2ban
on your server. If you've installed with composer, the location is vendor/bin/aws-acl-fail2ban
, otherwise the location is in bin/aws-acl-fail2ban
. You should use the absolute path when updating actionban
and actionunban
.ACL_ID_GOES_HERE
in /etc/fail2ban/action.d/aws-acl.conf
with the acl-id of the ACL that you would like to use.Create or update your jail.local configuration. Replace the filter definition below with your own filter if you have one. The example filter configuration included in this package will match all POST and GET requests that are not images, css or javascript (note this doesn't include font files as of this time, but it probably should). The filter together with the jail.local configuration here will be useful for stopping crawl attempts and certain types of HTTP Flood DoS or brute force attacks. Here's an example jail.local configuration:
[aws-acl-example]
enabled = true
filter = aws-acl-example-filter
action = aws-acl
sendmail-whois[name=LoginDetect, dest=youremail@example.com, sender=youremail@local.hostname, sendername="Fail2Ban"]
logpath = /var/log/apache2/access.log
maxretry = 60
findtime = 60
bantime = 14400