Set the state to 1 (Blocked)

[fahmiegerton]

Hi, Sorry to ask this kinda question, but when I query the ipban.sqlite, according the Wikis, 3 is just fail login only, how to set it to ban? Thanks!

IPAddress = ?!J
   IPAddressText = 209.141.33.74
 LastFailedLogin = 1619830904233
FailedLoginCount = 2
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = k??:
   IPAddressText = 107.151.182.58
 LastFailedLogin = 1619797952806
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ?i??
   IPAddressText = 172.105.172.151
 LastFailedLogin = 1619802346356
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = B??"
   IPAddressText = 66.240.205.34
 LastFailedLogin = 1619802842982
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ???
   IPAddressText = 192.241.214.143
 LastFailedLogin = 1619804001698
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ?♫??
   IPAddressText = 128.14.134.134
 LastFailedLogin = 1619804889359
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ???-
   IPAddressText = 192.241.218.45
 LastFailedLogin = 1619805400856
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ?n?
   IPAddressText = 143.110.243.141
 LastFailedLogin = 1619805400856
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = va2←
   IPAddressText = 118.97.50.27
 LastFailedLogin = 1619806092833
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = X♣?

   IPAddressText = 88.5.237.10
 LastFailedLogin = 1619806694613
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ?I?
   IPAddressText = 178.73.215.171
 LastFailedLogin = 1619808274731
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ??N?
   IPAddressText = 178.175.78.240
 LastFailedLogin = 1619808801478
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = -?~?
   IPAddressText = 45.155.126.222
 LastFailedLogin = 1619809719296
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ????
   IPAddressText = 192.241.215.206
 LastFailedLogin = 1619810922793
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ?>?(
   IPAddressText = 162.62.133.40
 LastFailedLogin = 1619812562717
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ???3
   IPAddressText = 192.241.215.51
 LastFailedLogin = 1619813570834
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = [m?E
   IPAddressText = 91.109.158.69
 LastFailedLogin = 1619814413436
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ??Le
   IPAddressText = 186.179.76.101
 LastFailedLogin = 1619814684317
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ??4=
   IPAddressText = 197.232.52.61
 LastFailedLogin = 1619815481820
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ?sI?
   IPAddressText = 203.115.73.132
 LastFailedLogin = 1619816324406
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = Jx♫7
   IPAddressText = 74.120.14.55
 LastFailedLogin = 1619820597425
FailedLoginCount = 2
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ♥♫H;
   IPAddressText = 3.14.72.59
 LastFailedLogin = 1619820732840
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = "?V→
   IPAddressText = 34.234.86.26
 LastFailedLogin = 1619821289518
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = S??♦
   IPAddressText = 83.147.223.4
 LastFailedLogin = 1619822192338
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ?!M?
   IPAddressText = 178.33.77.250
 LastFailedLogin = 1619823591766
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = m?C?
   IPAddressText = 109.195.67.172
 LastFailedLogin = 1619823922852
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ?⌂u↨
   IPAddressText = 179.127.117.23
 LastFailedLogin = 1619826420520
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ?♫?"
   IPAddressText = 128.14.141.34
 LastFailedLogin = 1619827112638
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ??◄>
   IPAddressText = 174.138.17.62
 LastFailedLogin = 1619827353415
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ☺???
   IPAddressText = 1.176.134.243
 LastFailedLogin = 1619832995540
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

       IPAddress = ?:hL
   IPAddressText = 176.58.104.76
 LastFailedLogin = 1619833296425
FailedLoginCount = 1
         BanDate =
           State = 3
      BanEndDate =
        UserName =
          Source = Nginx

[fahmiegerton]

Wait, why I get this? It should be blocked, not forget it.

2021-05-02 06:36:42.0166|WARN|DigitalRuby.IPBanCore.Logger|Forgetting failed login ip address 83.147.223.4, time expired
2021-05-02 07:00:01.2748|WARN|DigitalRuby.IPBanCore.Logger|Forgetting failed login ip address 178.33.77.250, time expired
2021-05-02 07:05:32.3235|WARN|DigitalRuby.IPBanCore.Logger|Forgetting failed login ip address 109.195.67.172, time expired
2021-05-02 07:47:09.9752|WARN|DigitalRuby.IPBanCore.Logger|Forgetting failed login ip address 179.127.117.23, time expired
2021-05-02 07:58:41.9743|WARN|DigitalRuby.IPBanCore.Logger|Forgetting failed login ip address 128.14.141.34, time expired
2021-05-02 08:02:42.7174|WARN|DigitalRuby.IPBanCore.Logger|Forgetting failed login ip address 174.138.17.62, time expired
2021-05-02 08:33:48.4621|WARN|DigitalRuby.IPBanCore.Logger|Login failure: 185.173.35.57, , Nginx, 1
2021-05-02 08:35:03.6881|WARN|DigitalRuby.IPBanCore.Logger|Login failure: 103.149.192.181, , Nginx, 1
2021-05-02 08:39:49.6069|WARN|DigitalRuby.IPBanCore.Logger|Login failure: 180.149.125.175, , Nginx, 3
2021-05-02 08:46:50.8626|WARN|DigitalRuby.IPBanCore.Logger|Login failure: 80.82.77.192, , Nginx, 1
2021-05-02 08:55:37.4254|WARN|DigitalRuby.IPBanCore.Logger|Login failure: 80.82.77.192, , Nginx, 2
2021-05-02 09:31:59.0305|WARN|DigitalRuby.IPBanCore.Logger|Login failure: 64.62.197.62, , Nginx, 1
2021-05-02 09:36:44.8977|WARN|DigitalRuby.IPBanCore.Logger|Forgetting failed login ip address 1.176.134.243, time expired
2021-05-02 09:41:45.8693|WARN|DigitalRuby.IPBanCore.Logger|Forgetting failed login ip address 176.58.104.76, time expired

Can you help me @jjxtra ? Thanks

[jjxtra]

Default is five fail logins before ban

[fahmiegerton]

Default is five fail logins before ban

Oh, alright thanks for the explanation @jjxtra. But, how do I just block the IP if the status code is met? For example, on the log, the IP 83.147.223.4 is get response HTTP status code 444 (which nginx just cut the connection I think), so if I set the http status code to 444 with the rule "banned" without waiting for five fail logins in config (for example), the IP is banned. Is there any way like this? thanks!

[jjxtra]

You can override FailedLoginThreshold per log file in the config.

[fahmiegerton]

You can override FailedLoginThreshold per log file in the config.

I did, seems didn't work or I misconfigure it. this is my current setting.

<!-- nginx, Windows -->
      <LogFile>

        <Source>Nginx</Source>
        <PathAndMask>
          C:/Wamp.NET/logs/**-access.log
        </PathAndMask>
        <FailedLoginRegex>
          <![CDATA[
            (?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) - - \[(?<dateandtime>\d{2}\/[a-z]{3}\/\d{4}:\d{2}:\d{2}:\d{2} (\+|\-)\d{4})\] (((\"(GET|POST|PUT|PATCH|DELETE|OPTIONS|HEAD|TRACE|CONNECT|[.*\\x.*]) )(?<url>.+)(http\/1\.(1|0)"))|.*\\x.*) (?<statuscode>(301|4(44|03|00))) (?<bytessent>\d+) (["](?<refferer>(\-)|(.+))["]) (["](?<useragent>.+)["])
          ]]>
        </FailedLoginRegex>
        <FailedLoginRegexTimestampFormat>dd/MMM/yyyy:HH:mm:ss zzzz</FailedLoginRegexTimestampFormat>
        <PlatformRegex>Windows</PlatformRegex>
        <PingInterval>10000</PingInterval>
        <MaxFileSize>16777216</MaxFileSize>
        <FailedLoginThreshold>0</FailedLoginThreshold>

      </LogFile>

[jjxtra]

It's still zero in your example.

[fahmiegerton]

It's still zero in your example.

So, what number should I set to ban an ip?

[jjxtra]

The default is five. If you keep the override at zero it will use five. You can change it to another number if you want.

On Sun, May 2, 2021 at 7:46 AM Arif Fahmi ***@***.***> wrote: It's still zero in your example. So, what number should I set to ban an ip? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#148 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJWQGGCS2DGCGNSZ5TY6U3TLVJT3ANCNFSM435ZQJUQ> .

-- -- Jeff

[fahmiegerton]

The default is five. If you keep the override at zero it will use five. You can change it to another number if you want.
On Sun, May 2, 2021 at 7:46 AM Arif Fahmi @.***> wrote: It's still zero in your example. So, what number should I set to ban an ip? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#148 (reply in thread)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAJWQGGCS2DGCGNSZ5TY6U3TLVJT3ANCNFSM435ZQJUQ .
-- -- Jeff

@jjxtra Is that block mean how many times ip failed to access resource before banned? I changed it to 2 but it seems the same.

[jjxtra]

That is correct, number of failed logins before ban. So are you saying putting in the override value is having no effect?

[fahmiegerton]

That is correct, number of failed logins before ban. So are you saying putting in the override value is having no effect?

Yes, I set it on 1 then 2 then 3 but no effect.

[jjxtra]

Can you post your ipban.config file?

[fahmiegerton]

Hi, I forgot about this thread, sorry. Tried with clean install, worked though. Sorry for not to keep update it. Thank you for your hard work!. And also, I have another problem, could you assist me in the new thread @jjxtra ? Thanks!

[jjxtra]

Drop a ban.txt file in the install folder with one ip per line to ban. It will get processed on the next cycle.