test

aws-ec2-apache-xmlrpc-dos-attack

#create a filter at /etc/fail2ban/filter.d/apache-xmlrpc.conf.

[Definition]
failregex = ^<HOST> .*POST .*xmlrpc\.php.*
ignoreregex =

#open /etc/fail2ban/jail.conf to add this rule:

[apache-xmlrpc]

enabled  = true
port     = http,https
filter   = apache-xmlrpc
action = iptables[name=apache-xmlrpc, port=http, protocol=tcp]
sendmail-whois[name=SSH, dest=you@youremailaddress.com, sender=fail2ban@yourserver.com]
logpath  = /var/log/httpd/access_log
maxretry = 6


#Restart fail2ban

#Check its logs to figure out if it worked

awk '($(NF-1) = /Ban/){print $NF}' /var/log/messages | sort | uniq -c | sort -n 
      1 188.0.236.9
      1 191.96.249.53
      1 191.96.249.54