Im working on a FastAPI project but I want to implement a fail2ban filter that blocks all abusive intents on my API.
So far i have created a log file that stores all API requests in a access.log
file
2024-05-09 09:02:20,013 | 172.20.101.226 | GET | /prediccion/1097116902/1543113/2024-01-02T15:10/fcv1234/ | 3072024-05-09 09:44:44,450 | 172.20.101.226 | GET | /prediccion/1097116902/1543113/2024-01-02T15:10/fcv1234/ | 3072024-05-09 09:45:29,932 | 172.20.101.226 | GET | /prediccion/1097116902/1543113/2024-01-02T15:10/fcv1234/ | 3072024-05-09 09:55:27,145 | 172.20.100.105 | GET | /favicon.ico | 4042024-05-09 10:05:46,924 | 172.20.101.226 | GET | /prediccion/1097116902/1543113/2024-01-02 15:10:00/fcv1234 | 2002024-05-09 10:08:47,131 | 172.20.100.105 | GET | / | 4042024-05-09 10:08:47,227 | 172.20.100.105 | GET | /favicon.ico | 4042024-05-09 10:08:48,262 | 172.20.100.105 | GET | / | 4042024-05-09 10:08:48,845 | 172.20.100.105 | GET | / | 4042024-05-09 10:08:49,292 | 172.20.100.105 | GET | / | 4042024-05-09 10:08:49,676 | 172.20.100.105 | GET | / | 4042024-05-09 10:08:49,997 | 172.20.100.105 | GET | / | 4042024-05-09 10:08:50,306 | 172.20.100.105 | GET | / | 4042024-05-09 10:08:50,531 | 172.20.100.105 | GET | / | 404
And the filter in sudo nano /etc/fail2ban/filter.d/fastapi.conf
[Definition]failregex = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3} \| <HOST> \| GET \| .* \| 404
And the jail.local file was modified by adding this
[fastapi]enabled = truefilter = fastapiport = 5002logpath = /home/admonda/py/PMV/access.logmaxretry = 5findtime = 600bantime = 3600
I cannot get it to work. Even if I perform multiple 404 errors via web browser, my ip address never gets banned