Issue How to properly configure Fail2Ban for ModSecurity in Plesk with NGINX?

[Kulturmensch]

Server operating system version

Ubuntu 22.04.5 LTS

Plesk version and microupdate number

Plesk Obsidian 18.0.67 Update #3

Hello everyone,

I have successfully installed ModSecurity with NGINX on my Plesk server. Now, I want to use Fail2Ban to permanently block IPs of attackers that ModSecurity identifies.

However, after installation, I noticed that the configuration files for ModSecurity were missing in Fail2Ban. Additionally, the plesk-modsecurity service could not be activated.

Could someone provide the original content of the Plesk Fail2Ban configuration files for ModSecurity? I would like to restore them and ensure they work correctly with my NGINX setup.

Thanks in advance!

 

[Kaspar]

Jail

[plesk-modsecurity]
enabled = true
filter = plesk-modsecurity
action = iptables-multiport[name="plesk-modsecurity", port="80,443,7080,7081", protocol="tcp,udp"]
logpath = /var/log/modsec_audit.log
maxretry = 4

Filter

[Definition]
failregex = ^(?:\[.*?\]\s\S*)\s<HOST>\s
ignoreregex = ^\[.*?\]\s\S*\s<HOST>\s.*\s\1
    collection_store
    collections_remove_stale

 

[Kulturmensch]

Thank you for your quick response! Unfortunately, Fail2Ban didn’t work because it couldn’t find any IPs in the ModSecurity audit log files, and ModSecurity itself stopped logging unexpectedly. As a result, I had to remove it again. Additionally, switching from the selected Apache rule set (2.9) to my proxy NGINX rule set (3.0) didn’t work either. I’ll give ModSecurity another try once it proves to be more stable in my environment.