Question Modsecurity in detection mode and fail2ban jail

[gabriel.mstowski]

Server operating system version

Ubuntu 24.04

Plesk version and microupdate number

18.0.69

Hello, has anyone figured out how to properly configure the fail2ban-modsecurity jail to work correctly with ModSecurity when it's in detection mode? Despite setting ModSecurity to detection mode, Fail2Ban is still blocking requests cause it doesn't care about if ModSec is on or in detection mode.

 

[Sebahat.hadzhi]

Hello, @gabriel.mstowski . Could you please provide a little bit more context to the issue you are experiencing with the modsecurity jail?

 

[pleskuser67553]

Allow me So, like many of us, I have multiple servers each with multiple websites. The server-wide setting for ModSecurity is On (Enabled). The server-wide setting for fail2ban is checked for Enable intrusion detection with plesk-modsecurity jail Active.

I have a website that is having trouble with some false positives. So, in Plesk, I have gone to ModSecurity in that domain's card and selected Detection Only.

However, fail2ban's default ModSecurity jail filter appears so basic that it does not distinguish between sites that are Engine-Mode: "ENABLED" or Engine-Mode: "DETECTION_ONLY".

[Definition]
failregex = ^(?:\[.*?\]\s\S*)\s<HOST>\s
ignoreregex = ^\[.*?\]\s\S*\s<HOST>\s.*\s\1

If Plesk expects that ModSecurity should work in conjunction with fail2ban and vice versa, and in the UI it gives the option to make a ModSecurity custom change per domain, then it should also provide the ability to make a custom change per domain for fail2ban (e.g. disable jails per domain). If that is not possible, then it should at the very least inform the user of such a situation and strive to improve fail2ban's supplied ModSecurity jail filter to ignore sites in Detection Only mode.

Granted, /var/log/modsec_audit.log is a rather complex logfile to analyse and regex

Unless I'm mistaken, the only workaround at present seems to be to disable in fail2ban server-wide the ModSecurity jail or ease its ban period/attempts while you learn what one or two sites is triggering false positives

Plesk Obsidian 18.0.79
OS: various RHEL flavours and versions.

 

[pleskuser67553]

then it should at the very least inform the user of such a situation

Okay, my bad, it kinda does.

Detection only
Each incoming HTTP request and the related response are checked against a set of rules. If the check succeeds, the HTTP request is passed to website content. If the check fails, the event is logged and ModSecurity performs no other actions. Other services (for example, Fail2ban) can still perform their own actions on HTTP requests that failed the check.

And thinking about it some more, one could argue there's a case for server-wide running ModSecurity in Detection Only mode in conjunction with fail2ban if you want to give the attacker fewer clues as to how quickly or often they're going to become banned. For example, when they learn how many attempts it takes to see an Apache error code, they just rotate IPs until they find the sweet spot.

On
Each incoming HTTP request and the related response are checked against a set of rules. If the check succeeds, the HTTP request is passed to website content. If the check fails, the event is logged, a notification is sent, and the HTTP response is provided with an error code.

 

[Kaspar]

And thinking about it some more, one could argue there's a case for server-wide running ModSecurity in Detection Only mode in conjunction with fail2ban if you want to give the attacker fewer clues as to how quickly or often they're going to become banned. For example, when they learn how many attempts it takes to see an Apache error code, they just rotate IPs until they find the sweet spot.

There also is a (minor) resource consideration. Which for me is the reason I prefer to run ModSecurity in Detection Only mode by default on production servers and adjust it per domain when needed.

 

[pleskuser67553]

Trouble is, if I set ModSecurity to Detection Only server-wide, the per-domain settings shows only Off or Detection Only options. So I'd need to set it On server-wide and then select Detection Only per domain for however many - that's a bit painful when there are many domains. Is this a limitation in ModSecurity or is Plesk missing some functionality here?

 

[Kaspar]

You are completely right. It's been a while since I've setup my WAF configuration and have touched it in years, so memory on this was a bit rusty. I had to lookup what my configuration exactly looks like again. I am actually have the server wide WAF settings default to on, but I use the Event Manager with the Physical hosting created event to run a script with the Plesk Domain command utility to set the WAF to Detection Only up on creation of a domain. Like so

/usr/local/psa/bin/domain --update-web-app-firewall example.com -waf-rule-engine detection-only

That way the WAF is set to Detection Only for each newly created domain and I can (or my customers) can turn it back on when needed.