Веб-сервер, атакованный перенаправленным трафиком

Question

В настоящее время мой веб-сервер, который используется только для моего личного сайта, перегружен перенаправленным трафиком. Я пытаюсь использовать fail2ban для уменьшения нагрузки, но мое Regex не так уж и велико.

Ниже приведен пример моего доступа войти

142.4.113.210 - - [03/Sep/2014:12:40:39 +0200] "GET http://ads.sonital.com/ttj?id=3139842&size=300x250&cb=[CACHEBUSTER] HTTP/1.0" 404 522 "http://www.seversname.com/?p=1387" "Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.1 Safari/532.0" 
184.105.160.169 - - [03/Sep/2014:12:40:39 +0200] "GET http://ads.sonital.com/ttj?id=3397183&size=300x250&cb=[CACHEBUSTER] HTTP/1.0" 404 522 "http://www.ibusinessstatistics.com/?p=1003" "Mozilla/4.0 (compatible; MSIE 7.0; AOL 9.0; Windows NT 6.0; 001|Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; .NET CLR 1.1.4322)" 
142.4.118.60 - - [03/Sep/2014:12:40:40 +0200] "GET http://ads.sonital.com/ttj?id=3139831&size=300x250&cb=[CACHEBUSTER] HTTP/1.0" 404 522 "http://www.selceticon.com/?p=892" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; Avant Browser; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; .NET CLR 3.5.21022; InfoPath.2)" 
142.4.113.215 - - [03/Sep/2014:12:40:40 +0200] "GET http://ads.sonital.com/ttj?id=3139842&size=300x250&cb=[CACHEBUSTER] HTTP/1.0" 404 522 "http://www.seversname.com/?p=1262" "Mozilla/4.0 (compatible; MSIE 7.0; AOL 9.5; AOLBuild 4337.42; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" 
192.74.240.178 - - [03/Sep/2014:12:40:40 +0200] "GET http://ads.sonital.com/ttj?id=3342345&size=300x250&cb=[CACHEBUSTER] HTTP/1.0" 404 522 "http://www.ifinanceblog.com/?p=1615" "Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.6; AOLBuild 4340.12; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" 

И вот мой журнал ошибок

[Wed Sep 03 12:47:59 2014] [error] [client 198.40.51.25] File does not exist: /var/www/ttj, referer: http://www.seversname.com/?p=1309 
[Wed Sep 03 12:47:59 2014] [error] [client 192.74.252.17] File does not exist: /var/www/ttj, referer: http://www.caridly.com/?p=1393 
[Wed Sep 03 12:47:59 2014] [error] [client 198.40.62.198] File does not exist: /var/www/ttj, referer: http://www.selceticon.com/?p=1281 
[Wed Sep 03 12:48:00 2014] [error] [client 198.40.62.237] File does not exist: /var/www/ttj, referer: http://www.selceticon.com/?p=1001 
[Wed Sep 03 12:48:00 2014] [error] [client 148.163.24.107] File does not exist: /var/www/tt, referer: http://www.elanceapc.com/?p=1515 
[Wed Sep 03 12:48:00 2014] [error] [client 137.175.105.79] File does not exist: /var/www/tt, referer: http://www.elanceapc.com/?p=1522 

Вот код из моего фильтра, который направлен в журнал ошибок.

before = apache-common.conf 
failregex = ^\[\w{1,3}.\w{1,3}.\d{1,2}.\d{1,2}:\d{1,2}:\d{1,2} \d{1,4}. \[error] \[client.<HOST>].File does not exist: ~* 
ignoreregex = 

Вот код из jail.local

[apache-nohome] 
enabled = true 
port  = http,https 
filter = apache-nohome 
logpath = /var/log/apache*/*error.log 
maxretry = 1 
findtime = 604800 
bantime = 604800 

Любая помощь будет оценена.

Answer 1

Ну по DOC, fail2ban имеет отличный инструмент: fail2ban-регулярок

корень @ сервер:/# fail2ban-регулярное выражение «ср 3 сентября 2014 12:48:00] [ошибка] [клиент 148,163. 24,107] Файл не существует:/вар/WWW/тт, реферер: '[ошибка] [клиент] Файл не существует.: ~ *' http://www.elanceapc.com/?p=1515 '

Running tests 
============= 

Use regex line : \[error] \[client.<HOST>\].File does not exist: ~* 
Use single line: Wed Sep 03 12:48:00 2014] [error] [client 148.163.... 


Results 
======= 

Failregex 
|- Regular expressions: 
| [1] \[error] \[client.<HOST>\].File does not exist: ~* 
| 
`- Number of matches: 
    [1] 1 match(es) 

Ignoreregex 
|- Regular expressions: 
| 
`- Number of matches: 

Summary 
======= 

Addresses found: 
[1] 
    148.163.24.107 (Wed Sep 03 12:48:00 2014) 

Date template hits: 
2 hit(s): MONTH Day Hour:Minute:Second 
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second Year 
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second 
0 hit(s): Year/Month/Day Hour:Minute:Second 
0 hit(s): Day/Month/Year Hour:Minute:Second 
0 hit(s): Day/Month/Year Hour:Minute:Second 
0 hit(s): Day/MONTH/Year:Hour:Minute:Second 
0 hit(s): Month/Day/Year:Hour:Minute:Second 
0 hit(s): Year-Month-Day Hour:Minute:Second 
0 hit(s): Day-MONTH-Year Hour:Minute:Second[.Millisecond] 
0 hit(s): Day-Month-Year Hour:Minute:Second 
0 hit(s): TAI64N 
0 hit(s): Epoch 
0 hit(s): ISO 8601 
0 hit(s): Hour:Minute:Second 
0 hit(s): <Month/Day/Year@Hour:Minute:Second> 

Success, the total number of match is 1 

Так правильное регулярное выражение будет \[error] \[client.<HOST>\].File does not exist: ~*

Я никогда не использовал fail2ban до ...