jail.local

# Block attempts to brute force http logins
[apache-auth] 
enabled = true 
port = http,https 
filter = apache-auth 
logpath = /var/log/apache2/*error.log 
maxretry = 3 
bantime = 600 
ignoreip = 127.0.0.1
 
# Block attempts to request suspcious URLs
[apache-overflows] 
enabled = true 
port = http,https 
filter = apache-overflows 
logpath = /var/log/apache2/*error.log 
maxretry = 3 
bantime = 600 
ignoreip = 127.0.0.1
 
# Block attempts to search for scripts that don't exist
[apache-noscript] 
enabled = true 
port = http,https 
filter = apache-noscript 
logpath = /var/log/apache2/*error.log 
maxretry = 3 
bantime = 600 
ignoreip = 127.0.0.1
 
# Block DOS attempts via a high number of GET requests
[http-get-dos] 
enabled = true 
port = http,https 
filter = http-get-dos 
logpath = /var/log/apache*/access.log 
maxretry = 400 
findtime = 400 
bantime = 200 
ignoreip = 192.168.15.189 
action = iptables[name=HTTP, port=http, protocol=tcp]

# Block attempts to brute force SSH logins
[ssh] 
enabled = true 
port = ssh 
filter = sshd 
logpath = /var/log/auth.log 
maxretry = 3 
bantime = 600 
ignoreip = 127.0.0.1

# Block port scans detected by portsentry
[portsentry]
enabled = true
logpath = /var/lib/portsentry/portsentry.history
maxretry = 1