fail2ban filter that catches attacks against log4j CVE-2021-44228
Copy this file to your fail2ban filter.d directory, which is usually something like
/etc/fail2ban/filter.d
or similar.
Add an apache-jndi section to your jail.local or jail.conf:
[apache-jndi]
enabled = true
filter = apache-jndi
port = http,https
logpath = /var/log/apache2/access.log
bantime = 86400
maxretry = 1
In case you need to monitor multiple sites, wildcards may help:
[apache-jndi]
enabled = true
filter = apache-jndi
port = http,https
logpath = /var/www/*/logs/access.log
bantime = 86400
maxretry = 1
Logpath for LAMP servers managed by ispConfig:
logpath = /var/www/clients/client*/web*/log/access.log
These are examples assuming
- A single try reveals that they're a bad guy
- You only want to block further http(s) traffic. Of course, you might as well block any other ports, too.
As of now, this regex catches jndi:ldap requests that contain "jndi:ldap" and one obfuscated version using "lower".
I'll add more as soon as I find them, but feel free to submit suggestions.
Yes and no. From a technical point of view, it does what it is supposed to to. It detects known formats of log4shell attempts and should at least keep those who don't put too much effort in their scans blocked from your machines. Unfortunately, the possibilities of masking / obfuscating these requests are unlimited, so keeping up with all possible RegEx variants might appear like a cat-and-mouse game.
If this saved you some time, why not Buy me a coffee? ;)