How to setup Fail2ban to detect Apache 404 attacks?

Now, let’s see how our Dedicated Engineers setup Fail2ban to block 404 scans and invalid request methods.

1) Create filter

Firstly, our Support Engineers create a filter in the location /etc/fail2ban/filter.d. Further, we add a set of rules to ban IPs that cause 404 errors.

For example, to monitor the Apache 404 requests, we create a filter file apache-404.conf in the location /etc/fail2ban/filter.d. The filter looks like this.

failregex = ^<HOST> - .* "(GET|POST|HEAD).*HTTP.*" 404 .*$
ignoreregex =.*(robots.txt|favicon.ico|jpg|png)

We define the regular expression to be matched under the failregex parameter. Here, the above regular expression identifies the IP address that is making too many 404 requests. And, the ignoreregex excludes the valid files such as robots.txt, favicon.io and the images.

2) Create a custom jail

Secondly, we add a new jail in the location /etc/fail2ban/jail.conf. This defines the Apache log path to be checked, maxretry, bantime etc.

For example, to create a custom jail that monitors the Apache 404 requests, we add the following code in the file /etc/fail2ban/jail.conf.

[apache-404]
enabled = true
port = http,https
filter = apache-404
logpath = /var/log/httpd/error_log
logpath = /var/log/httpd/access_log
bantime = 3600
findtime = 600
maxretry = 5

 Here, we update the apache log file under logpath parameter. Similarly, the bantime, species how many seconds an offending IP is banned for. We always set this value to an optimum level, so that it’s not short to affect the legitimate users, while not long enough favoring malicious users.

Further, the maxretry parameter specifies the total number of connection attempts. So, if a client makes retry attempts more than maxretry value within the time specified in findtime parameter, they will be banned.

GitHub’s CSP journey

We shipped subresource integrity a few months back to reduce the risk of a compromised CDN serving malicious JavaScript. That is a big win, but does not address related content injection issues that may exist on GitHub.com itself. We have been tackling this side of the problem over the past few years and thought it would be fun, and hopefully useful, to share what we have been up to.

Just to get everyone on the same page, when talking about “content injection” we are talking about:

  • Cross Site Scripting (XSS) – Yup, the most common web vulnerability of the past, present, and foreseeable future. Given its prevalence, many developers are familiar with XSS and the obvious security consequences of allowing injected JavaScript to execute on your site.
  • Scriptless attacks – This is a more nuanced issue and is frequently not considered since people are too busy fending off XSS. But, as has been documented by Michal Zalewski in “Postcards from the post-XSS world”, Mario Heiderich (et al) in “Scriptless Attacks –
    Stealing the Pie Without Touching the Sill”
    , and other related work, preventing XSS does not solve all of your content injection problems.

GitHub uses auto-escaping templates, code review, and static analysis to try to prevent these kinds of bugs from getting introduced in the first place, but history shows they are unavoidable. Any strategy that relies on preventing any and all content injection bugs is bound for failure and will leave your engineers, and security team, constantly fighting fires. We decided that the only practical approach is to pair prevention and detection with additional defenses that make content injection bugs much more difficult for attackers to exploit. As with most problems, there is no single magical fix, and therefore we have employed multiple techniques to help with mitigation. In this post we will focus on our ever evolving use of Content Security Policy (CSP), as it is our single most effective mitigation. We can’t wait to follow up on this blog to additionally review some of the “non-traditional” approaches we have taken to further mitigate content injection.

What is CSP? Why & How to Add it to Your Website.

For example, a common way to steal logins using CSS is by sending a request for a background image or font to an evil URL such as  where a is the letter you typed into the password login field. When you would type the next letter of your password, the evil CSS script would send another request but with that letter instead of a. The evil site then logs these requests to determine your username & password. By allowing unsafe-inline for our style-src, someone could inject this evil code. Fortunately, their code wouldn’t work since our CSP doesn’t allow img-src & font-src from the evil example site.

You are also not in bad company by doing this. A lot of sites, including GitHub & security professional Troy Hunt’s blog use unsafe-inline. Facebook uses unsafe-eval & even requires it for some of their SDKs. Anyone using Google Tag Manager for analytics will also have to reduce their CSP security. I must confess as well. I use GatsbyJS for my personal blog & there are issues that need to be fixed before I can remove unsafe-inline.

Individuation (Richard Rohr)

Just what are those inner imperatives that rise to support us and challenge us in the journey of the second half of life? Perhaps Jung’s most compelling contribution is the idea of individuation, that is, the lifelong project of becoming more nearly the whole person we were meant to be—what [God] intended, not the parents, or the tribe, or, especially, the easily intimidated or inflated ego.

While revering the mystery of others, our individuation summons each of us to stand in the presence of our own mystery, and become more fully responsible for who we are in this journey we call our life. So often the idea of individuation has been confused with self-indulgence or mere individualism, but what individuation more often asks of us is the surrender of the ego’s agenda of security and emotional reinforcement, in favor of humbling service to the soul’s intent. . . .

The agenda of the first half of life is predominantly . . . framed as “How can I enter this world, separate from my parents, create relationships, career, social identity?” Or put another way: “What does the world ask of me, and what resources can I muster to meet its demands?” But in the second half of life . . . the agenda shifts to reframing our personal experience in the larger order of things, and the questions change. “What does the soul ask of me?” “What does it mean that I am here?” “Who am I apart from my roles, apart from my history?” . . . If the agenda of the first half of life is social, meeting the demands and expectations our milieu asks of us, then the questions of the second half of life are spiritual, addressing the larger issue of meaning.

The psychology of the first half of life is driven by the fantasy of acquisitiongaining ego strength to deal with separation, separating from the overt domination of parents, acquiring a standing in the world. . . . But then the second half of life asks of us, and ultimately demands, relinquishment—relinquishment of identification with property, roles, status, provisional identities—and the embrace of other, inwardly confirmed values.

Microsoft, Facebook, trust and privacy

I’ve been reminded of this ancient history a lot in the last year or two as I’ve looked at news around abuse and hostile state activity on Facebook, YouTube and other social platforms, because much like the Microsoft macro viruses, the ‘bad actors’ on Facebook did things that were in the manual. They didn’t prise open a locked window at the back of the building – they knocked on the front door and walked in. They did things that you were supposed to be able to do, but combined them in an order and with malign intent that hadn’t really been anticipated.

It’s also interesting to compare the public discussion of Microsoft and of Facebook before these events. In the  1990s, Microsoft was the ‘evil empire’, and a lot of the narrative within tech focused on how it should be more open, make it easier for people to develop software that worked with the Office monopoly, and make it easier to move information in and out of its products. Microsoft was ‘evil’ if it did anything to make life harder for developers. Unfortunately, whatever you thought of this narrative, it pointed in the wrong direction when it came to this use case. Here, Microsoft was too open, not too closed.

Equally, in the last 10 years   – that is is too hard to get your information out and too hard for researchers to pull information from across the platform. People have argued that Facebook was too restrictive on how third party developers could use the platform. And people have objected to Facebook’s attempts to enforce the single real identities of accounts. As for Microsoft, there may well have been justice in all of these arguments, but also as for Microsoft, they pointed in the wrong direction when it came to this particular scenario. For the Internet Research Agency, it was too easy to develop for Facebook, too easy to get data out, and too easy to change your identity. The walled garden wasn’t walled enough.

.. Conceptually, this is almost exactly what Facebook has done: try to remove existing opportunities for abuse and avoid creating new ones, and scan for bad actors.

Microsoft Facebook
Remove openings for abuse Close down APIs and look for vulnerabilities Close down APIs and look for vulnerabilities
Scan for bad behavior Virus and malware scanners Human moderation

(It’s worth noting that these steps were precisely what people had previously insisted was evil – Microsoft deciding what code you can run on your own computer and what APIs developers can use, and Facebook deciding (people demanding that Facebook decide) who and what it distributes.)

  • .. If there is no data stored on your computer then compromising the computer doesn’t get an attacker much.
  • An application can’t steal your data if it’s sandboxed and can’t read other applications’ data.
  • An application can’t run in the background and steal your passwords if applications can’t run in the background.
  • And you can’t trick a user into installing a bad app if there are no apps.

Of course, human ingenuity is infinite, and this change just led to the creation of new attack models, most obviously phishing, but either way, none of this had much to do with Microsoft. We ‘solved’ viruses by moving to new architectures that removed the mechanics that viruses need, and where Microsoft wasn’t present.

.. In other words, where Microsoft put better locks and a motion sensor on the windows, the world is moving to a model where the windows are 200 feet off the ground and don’t open.

.. Much like moving from Windows to cloud and ChromeOS, you could see this as an attempt to remove the problem rather than patch it.

  • Russians can’t go viral in your newsfeed if there is no newsfeed.
  • ‘Researchers’ can’t scrape your data if Facebook doesn’t have your data. You solve the problem by making it irrelevant.

This is one way to solve the problem by changing the core mechanics, but there are others. For example, Instagram does have a one-to-many feed but does not suggest content from people you don’t yourself follow in the main feed and does not allow you to repost into your friends’ feeds. There might be anti-vax content in your feed, but one of your actual friends has to have decided to share it with you. Meanwhile, problems such as the spread of dangerous rumours in India rely on messaging rather than sharing – messaging isn’t a panacea. 

Indeed, as it stands Mr Zuckerberg’s memo raises as many questions as it answers – most obviously, how does advertising work? Is there advertising in messaging, and if so, how is it targeted? Encryption means Facebook doesn’t know what you’re talking about, but the Facebook apps on your phone necessarily would know (before they encrypt it), so does targeting happen locally? Meanwhile, encryption in particular poses problems for tackling other kinds of abuse: how do you help law enforcement deal with child exploitation if you can’t read the exploiters’ messages (the memo explicitly talks about this as a challenge)? Where does Facebook’s Blockchain project sit in all of this?

There are lots of big questions, though of course there would also have been lots of questions if in 2002 you’d said that all enterprise software would go to the cloud. But the difference here is that Facebook is trying (or talking about trying) to do the judo move itself, and to make a fundamental architectural change that Microsoft could not.

Statement from President Donald J. Trump on Standing with Saudi Arabia

The world is a very dangerous place!

The country of Iran, as an example, is responsible for a bloody proxy war against Saudi Arabia in Yemen, trying to destabilize Iraq’s fragile attempt at democracy, supporting the terror group Hezbollah in Lebanon, propping up dictator Bashar Assad in Syria (who has killed millions of his own citizens), and much more. Likewise, the Iranians have killed many Americans and other innocent people throughout the Middle East. Iran states openly, and with great force, “Death to America!” and “Death to Israel!” Iran is considered “the world’s leading sponsor of terror.”

On the other hand, Saudi Arabia would gladly withdraw from Yemen if the Iranians would agree to leave. They would immediately provide desperately needed humanitarian assistance. Additionally, Saudi Arabia has agreed to spend billions of dollars in leading the fight against Radical Islamic Terrorism.

After my heavily negotiated trip to Saudi Arabia last year, the Kingdom agreed to spend and invest $450 billion in the United States. This is a record amount of money. It will create hundreds of thousands of jobs, tremendous economic development, and much additional wealth for the United States. Of the $450 billion, $110 billion will be spent on the purchase of military equipment from Boeing, Lockheed Martin, Raytheon and many other great U.S. defense contractors. If we foolishly cancel these contracts, Russia and China would be the enormous beneficiaries – and very happy to acquire all of this newfound business. It would be a wonderful gift to them directly from the United States!

The crime against Jamal Khashoggi was a terrible one, and one that our country does not condone. Indeed, we have taken strong action against those already known to have participated in the murder. After great independent research, we now know many details of this horrible crime. We have already sanctioned 17 Saudis known to have been involved in the murder of Mr. Khashoggi, and the disposal of his body.

Representatives of Saudi Arabia say that Jamal Khashoggi was an “enemy of the state” and a member of the Muslim Brotherhood, but my decision is in no way based on that – this is an unacceptable and horrible crime. King Salman and Crown Prince Mohammad bin Salman vigorously deny any knowledge of the planning or execution of the murder of Mr. Khashoggi. Our intelligence agencies continue to assess all information, but it could very well be that the Crown Prince had knowledge of this tragic event – maybe he did and maybe he didn’t!

That being said, we may never know all of the facts surrounding the murder of Mr. Jamal Khashoggi. In any case, our relationship is with the Kingdom of Saudi Arabia. 1 They have been a great ally in our very important fight against Iran. The United States intends to remain a steadfast partner of Saudi Arabia to ensure the interests of our country, Israel and all other partners in the region. It is our paramount goal to fully eliminate the threat of terrorism throughout the world! 2

I understand there are members of Congress who, for political or other reasons, would like to go in a different direction – and they are free to do so. I will consider whatever ideas are presented to me, but only if they are consistent with the absolute security and safety of America. After the United States, Saudi Arabia is the largest oil producing nation in the world. 3 They have worked closely with us and have been very responsive to my requests to keeping oil prices at reasonable levels – so important for the world. As President of the United States I intend to ensure that, in a very dangerous world, America is pursuing its national interests and vigorously contesting countries that wish to do us harm. Very simply it is called America First!

 


  1. Not free-speech or justice

  2. yes, and fully and forever eliminate the threat of murder too

  3. what is the connection between the security and safety of America and oil?  Did I missed the connecting transition?