The es-nginx-access module was developed by Extra Systems to protect the nginx web server from hacker activity within the fail2ban system. Its purpose is to detect suspicious activity in the /var/log/nginx/access.log file.
To connect es-nginx-access to fail2ban, use the following configuration:
[es-nginx-access] enabled = true filter = es-nginx-access logpath = /var/log/nginx/access.log action = iptables-allports[name=es-nginx-access, blocktype=DROP, protocol=all]
Please note that this filter blocks all protocols on all ports for the identified hacker, using the DROP method. This turns your host into a complete "black hole" for this particular attacker. They will not receive any response to any subsequent IP packets. This approach significantly reduces the load on your server's resources.
The code for our es-nginx-access filter looks like this:
[Definition]
failregex = ^<HOST> - - \[.*\] "GET .*/\.(env|git|aws).* HTTP/.*" 404
^<HOST> - - \[.*\] "GET / HTTP/1.1" 404
^<HOST> - - \[.*\] "(GET|POST) /\.(?!well-known/acme-challenge/).*" 404
^<HOST> - - \[.*\] "(GET|POST|PUT) /.*\.(php|json|js|sql|yml) HTTP/.*" 404
^<HOST> - - \[.*\] ".*" 400
^<HOST> - - \[.*\] "GET /ip HTTP/.*" 404
^<HOST> - - \[.*\] "(GET|POST|PUT) /.*(\.\.\/|cgi-bin|eval-stdin).*" 404
^<HOST> - - \[.*\] "POST //? HTTP/.*" 405
^<HOST> - - \[.*\] "GET //?(admin|login(\.\S+)?|whm|cpanel) HTTP/.*" 404
^<HOST> - - \[.*\] "PROPFIND / HTTP/.*" 405
^<HOST> - - \[.*\] "GET /SDK/.* HTTP/.*" 404
ignoreregex =
The following filter line deserves special attention
^<HOST> - - \[.*\] "GET / HTTP/1.1" 404
This is our proprietary architectural solution, implementing a preventative honeypot at the HTTP protocol level. The method's essence lies in thwarting automated scanners during the initial reconnaissance stage, when a bot performs a blanket crawl of the network by IP addresses, not yet knowing the target domain name. A typical user never directly enters a server's IP address into the browser's address bar to request a website's root address, so any such attempt that results in a 404 error is guaranteed to identify a blind hacker scanner or aggressive parser. However, for this elegant honeypot to activate, a mandatory condition must be met: the default server block must be physically removed from the server. On a clean Nginx web server, requests "by IP" are intercepted by the default stub and return a 200 OK status code, rendering the honeypot inactive.
Running the following command
rm /etc/nginx/sites-enabled/default
and restarting Nginx forces the server to respond with a 404 Not Found code to any requests that bypass legitimate domain names, turning a standard error into a powerful and silent proactive defense tool.
In practical use on our Linux servers, this filter has proven to be very effective in suppressing hacker activity within the nginx web server.
The content of this page is also available in Russian.
| © Extra Systems, 2026 |
|