400 Bad Request

Antworten
FarrowTheBlockHead2
Beiträge: 2
Registriert: 3. Mär 2016, 01:18

400 Bad Request

Beitrag von FarrowTheBlockHead2 » 3. Mär 2016, 01:25

2016-03-02 18:54:34,067 fail2ban.action [7443]: ERROR curl --fail --data-urlencode 'server=email@host.com' --data 'apikey=apikey' --data 'service=ssh' --data 'ip=210.51.13.120' --data-urlencode 'logs=Mar 1 12:42:47 sun sshd\[8582\]: Invalid user ubnt from 210.51.13.120' --data 'format=text' --user-agent "fail2ban v0.8.12" "https://www.blocklist.de/en/httpreports.html?" -- stderr: ' % Total % Received % Xferd Average Speed Time Time Time Current\n Dload Upload Total Spent Left Speed\n\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0\r 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0\r100 205 0 0 100 205 0 136 0:00:01 0:00:01 --:--:-- 136\r100 205 0 0 100 205 0 81 0:00:02 0:00:02 --:--:-- 81curl: (22) The requested URL returned error: 400 Bad Request\n'


Server and apikey have been changed for forum but any ideas please?

Benutzeravatar
Martin
Beiträge: 397
Registriert: 14. Sep 2010, 11:54
Kontaktdaten:

Re: 400 Bad Request

Beitrag von Martin » 3. Mär 2016, 06:44

Hello FarrowTheBlockHead2,
Please make the curl-Action manually, but without "--fail", then you got the Body back. At the Format "text", you see then some Lines, and there stands a "Error: xxxx" line with the reason.
I think, that the Logs was too short and need more characters. Can you change the maxentry/maxretry up to "3", then i think it will be work.
Mfg Martin
http://www.blocklist.de/de/ Fail2Ban Reporting Service

FarrowTheBlockHead2
Beiträge: 2
Registriert: 3. Mär 2016, 01:18

Re: 400 Bad Request

Beitrag von FarrowTheBlockHead2 » 5. Mär 2016, 03:39

Martin

Sorry had to wait for another attack greater or equal to 3 by the same ip address. That is exactly what it was. You are the man. So now it reports properly on the blocklist.de website - that I have one attack.

I had it set to one try as I have my ssh open to certificate only so any one else other than myself accessing ssh I was trying to ban but I am ok with 3.

Thanks again - cool service.

Paul

gnutella
Beiträge: 7
Registriert: 4. Mär 2016, 19:42

Re: 400 Bad Request

Beitrag von gnutella » 6. Mär 2016, 14:41

Out of interest, how to log fail2ban report to blocklist.de?
I cannot find any fail2ban.action in the log.

Benutzeravatar
Martin
Beiträge: 397
Registriert: 14. Sep 2010, 11:54
Kontaktdaten:

Re: 400 Bad Request

Beitrag von Martin » 6. Mär 2016, 19:11

Hello Paul,

when you change the Debug-Level in the fail2ban.conf up to "4" (debug), you can see the actions and errors, which do fail2ban.
At blocklist.de you can see under "Server" and the Button/Picture" list ips, your reported IPs.
Mfg Martin
http://www.blocklist.de/de/ Fail2Ban Reporting Service

Antworten