Set the state to 1 (Blocked) #148

fahmiegerton · 2021-05-01T02:03:53Z

fahmiegerton
May 1, 2021

Hi, Sorry to ask this kinda question, but when I query the ipban.sqlite, according the Wikis, 3 is just fail login only, how to set it to ban? Thanks!

IPAddress = ?!J
   IPAddressText = 209.141.33.74
 LastFailedLogin = 1619830904233
FailedLoginCount = 2
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = k??:
   IPAddressText = 107.151.182.58
 LastFailedLogin = 1619797952806
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ?i??
   IPAddressText = 172.105.172.151
 LastFailedLogin = 1619802346356
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = B??"
   IPAddressText = 66.240.205.34
 LastFailedLogin = 1619802842982
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ???
   IPAddressText = 192.241.214.143
 LastFailedLogin = 1619804001698
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ?♫??
   IPAddressText = 128.14.134.134
 LastFailedLogin = 1619804889359
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ???-
   IPAddressText = 192.241.218.45
 LastFailedLogin = 1619805400856
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ?n?
   IPAddressText = 143.110.243.141
 LastFailedLogin = 1619805400856
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = va2←
   IPAddressText = 118.97.50.27
 LastFailedLogin = 1619806092833
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = X♣?

   IPAddressText = 88.5.237.10
 LastFailedLogin = 1619806694613
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ?I?
   IPAddressText = 178.73.215.171
 LastFailedLogin = 1619808274731
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ??N?
   IPAddressText = 178.175.78.240
 LastFailedLogin = 1619808801478
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = -?~?
   IPAddressText = 45.155.126.222
 LastFailedLogin = 1619809719296
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ????
   IPAddressText = 192.241.215.206
 LastFailedLogin = 1619810922793
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ?>?(
   IPAddressText = 162.62.133.40
 LastFailedLogin = 1619812562717
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ???3
   IPAddressText = 192.241.215.51
 LastFailedLogin = 1619813570834
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = [m?E
   IPAddressText = 91.109.158.69
 LastFailedLogin = 1619814413436
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ??Le
   IPAddressText = 186.179.76.101
 LastFailedLogin = 1619814684317
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ??4=
   IPAddressText = 197.232.52.61
 LastFailedLogin = 1619815481820
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ?sI?
   IPAddressText = 203.115.73.132
 LastFailedLogin = 1619816324406
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = Jx♫7
   IPAddressText = 74.120.14.55
 LastFailedLogin = 1619820597425
FailedLoginCount = 2
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ♥♫H;
   IPAddressText = 3.14.72.59
 LastFailedLogin = 1619820732840
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = "?V→
   IPAddressText = 34.234.86.26
 LastFailedLogin = 1619821289518
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = S??♦
   IPAddressText = 83.147.223.4
 LastFailedLogin = 1619822192338
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ?!M?
   IPAddressText = 178.33.77.250
 LastFailedLogin = 1619823591766
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = m?C?
   IPAddressText = 109.195.67.172
 LastFailedLogin = 1619823922852
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ?⌂u↨
   IPAddressText = 179.127.117.23
 LastFailedLogin = 1619826420520
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ?♫?"
   IPAddressText = 128.14.141.34
 LastFailedLogin = 1619827112638
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ??◄>
   IPAddressText = 174.138.17.62
 LastFailedLogin = 1619827353415
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ☺???
   IPAddressText = 1.176.134.243
 LastFailedLogin = 1619832995540
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ?:hL
   IPAddressText = 176.58.104.76
 LastFailedLogin = 1619833296425
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

Answered by jjxtra

May 2, 2021

You can override FailedLoginThreshold per log file in the config.

View full answer

fahmiegerton · 2021-05-02T02:24:50Z

fahmiegerton
May 2, 2021
Author

Wait, why I get this? It should be blocked, not forget it.

2021-05-02 06:36:42.0166|WARN|DigitalRuby.IPBanCore.Logger|Forgetting failed login ip address 83.147.223.4, time expired
2021-05-02 07:00:01.2748|WARN|DigitalRuby.IPBanCore.Logger|Forgetting failed login ip address 178.33.77.250, time expired
2021-05-02 07:05:32.3235|WARN|DigitalRuby.IPBanCore.Logger|Forgetting failed login ip address 109.195.67.172, time expired
2021-05-02 07:47:09.9752|WARN|DigitalRuby.IPBanCore.Logger|Forgetting failed login ip address 179.127.117.23, time expired
2021-05-02 07:58:41.9743|WARN|DigitalRuby.IPBanCore.Logger|Forgetting failed login ip address 128.14.141.34, time expired
2021-05-02 08:02:42.7174|WARN|DigitalRuby.IPBanCore.Logger|Forgetting failed login ip address 174.138.17.62, time expired
2021-05-02 08:33:48.4621|WARN|DigitalRuby.IPBanCore.Logger|Login failure: 185.173.35.57, , Nginx, 1
2021-05-02 08:35:03.6881|WARN|DigitalRuby.IPBanCore.Logger|Login failure: 103.149.192.181, , Nginx, 1
2021-05-02 08:39:49.6069|WARN|DigitalRuby.IPBanCore.Logger|Login failure: 180.149.125.175, , Nginx, 3
2021-05-02 08:46:50.8626|WARN|DigitalRuby.IPBanCore.Logger|Login failure: 80.82.77.192, , Nginx, 1
2021-05-02 08:55:37.4254|WARN|DigitalRuby.IPBanCore.Logger|Login failure: 80.82.77.192, , Nginx, 2
2021-05-02 09:31:59.0305|WARN|DigitalRuby.IPBanCore.Logger|Login failure: 64.62.197.62, , Nginx, 1
2021-05-02 09:36:44.8977|WARN|DigitalRuby.IPBanCore.Logger|Forgetting failed login ip address 1.176.134.243, time expired
2021-05-02 09:41:45.8693|WARN|DigitalRuby.IPBanCore.Logger|Forgetting failed login ip address 176.58.104.76, time expired

Can you help me @jjxtra ? Thanks

2 replies

jjxtra May 2, 2021
Maintainer

Default is five fail logins before ban

fahmiegerton May 2, 2021
Author

Default is five fail logins before ban

Oh, alright thanks for the explanation @jjxtra. But, how do I just block the IP if the status code is met? For example, on the log, the IP 83.147.223.4 is get response HTTP status code 444 (which nginx just cut the connection I think), so if I set the http status code to 444 with the rule "banned" without waiting for five fail logins in config (for example), the IP is banned. Is there any way like this? thanks!

jjxtra · 2021-05-02T03:49:28Z

jjxtra
May 2, 2021
Maintainer

You can override FailedLoginThreshold per log file in the config.

3 replies

fahmiegerton May 2, 2021
Author

You can override FailedLoginThreshold per log file in the config.

I did, seems didn't work or I misconfigure it. this is my current setting.

<!-- nginx, Windows -->
      <LogFile>

        <Source>Nginx</Source>
        <PathAndMask>
          C:/Wamp.NET/logs/**-access.log
        </PathAndMask>
        <FailedLoginRegex>
          <![CDATA[
            (?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) - - \[(?<dateandtime>\d{2}\/[a-z]{3}\/\d{4}:\d{2}:\d{2}:\d{2} (\+|\-)\d{4})\] (((\"(GET|POST|PUT|PATCH|DELETE|OPTIONS|HEAD|TRACE|CONNECT|[.*\\x.*]) )(?<url>.+)(http\/1\.(1|0)"))|.*\\x.*) (?<statuscode>(301|4(44|03|00))) (?<bytessent>\d+) (["](?<refferer>(\-)|(.+))["]) (["](?<useragent>.+)["])
          ]]>
        </FailedLoginRegex>
        <FailedLoginRegexTimestampFormat>dd/MMM/yyyy:HH:mm:ss zzzz</FailedLoginRegexTimestampFormat>
        <PlatformRegex>Windows</PlatformRegex>
        <PingInterval>10000</PingInterval>
        <MaxFileSize>16777216</MaxFileSize>
        <FailedLoginThreshold>0</FailedLoginThreshold>

      </LogFile>

jjxtra May 2, 2021
Maintainer

It's still zero in your example.

fahmiegerton May 2, 2021
Author

It's still zero in your example.

So, what number should I set to ban an ip?

jjxtra · 2021-05-02T14:28:54Z

jjxtra
May 2, 2021
Maintainer

The default is five. If you keep the override at zero it will use five. You can change it to another number if you want.

On Sun, May 2, 2021 at 7:46 AM Arif Fahmi ***@***.***> wrote: It's still zero in your example. So, what number should I set to ban an ip? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#148 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJWQGGCS2DGCGNSZ5TY6U3TLVJT3ANCNFSM435ZQJUQ> .

-- -- Jeff

5 replies

fahmiegerton May 7, 2021
Author

The default is five. If you keep the override at zero it will use five. You can change it to another number if you want.
On Sun, May 2, 2021 at 7:46 AM Arif Fahmi @.***> wrote: It's still zero in your example. So, what number should I set to ban an ip? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#148 (reply in thread)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAJWQGGCS2DGCGNSZ5TY6U3TLVJT3ANCNFSM435ZQJUQ .
-- -- Jeff

@jjxtra Is that block mean how many times ip failed to access resource before banned? I changed it to 2 but it seems the same.

jjxtra May 8, 2021
Maintainer

That is correct, number of failed logins before ban. So are you saying putting in the override value is having no effect?

fahmiegerton May 9, 2021
Author

That is correct, number of failed logins before ban. So are you saying putting in the override value is having no effect?

Yes, I set it on 1 then 2 then 3 but no effect.

jjxtra May 9, 2021
Maintainer

Can you post your ipban.config file?

fahmiegerton May 22, 2021
Author

Hi, I forgot about this thread, sorry. Tried with clean install, worked though. Sorry for not to keep update it. Thank you for your hard work!. And also, I have another problem, could you assist me in the new thread @jjxtra ? Thanks!

jjxtra · 2021-05-22T17:55:44Z

jjxtra
May 22, 2021
Maintainer

Drop a ban.txt file in the install folder with one ip per line to ban. It will get processed on the next cycle.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Set the state to 1 (Blocked) #148

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 4 comments 10 replies

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Set the state to 1 (Blocked) #148

fahmiegerton May 1, 2021

Replies: 4 comments · 10 replies

fahmiegerton May 2, 2021 Author

jjxtra May 2, 2021 Maintainer

fahmiegerton May 2, 2021 Author

jjxtra May 2, 2021 Maintainer

fahmiegerton May 2, 2021 Author

jjxtra May 2, 2021 Maintainer

fahmiegerton May 2, 2021 Author

jjxtra May 2, 2021 Maintainer

fahmiegerton May 7, 2021 Author

jjxtra May 8, 2021 Maintainer

fahmiegerton May 9, 2021 Author

jjxtra May 9, 2021 Maintainer

fahmiegerton May 22, 2021 Author

jjxtra May 22, 2021 Maintainer

fahmiegerton
May 1, 2021

Replies: 4 comments 10 replies

fahmiegerton
May 2, 2021
Author

jjxtra May 2, 2021
Maintainer

fahmiegerton May 2, 2021
Author

jjxtra
May 2, 2021
Maintainer

fahmiegerton May 2, 2021
Author

jjxtra May 2, 2021
Maintainer

fahmiegerton May 2, 2021
Author

jjxtra
May 2, 2021
Maintainer

fahmiegerton May 7, 2021
Author

jjxtra May 8, 2021
Maintainer

fahmiegerton May 9, 2021
Author

jjxtra May 9, 2021
Maintainer

fahmiegerton May 22, 2021
Author

jjxtra
May 22, 2021
Maintainer