The es-nginx-errors module was developed by Extra Systems to protect the nginx web server from hacker activity within the fail2ban system. Its purpose is to detect suspicious activity in the /var/log/nginx/error.log file.
To connect es-nginx-errors to fail2ban, use the following configuration:
[es-nginx-errors] enabled = true filter = es-nginx-errors logpath = /var/log/nginx/error.log action = iptables-allports[name=es-nginx-errors, blocktype=DROP, protocol=all]
Please note that this filter blocks all protocols on all ports for the identified hacker, using the DROP method. This turns your host into a complete "black hole" for this particular attacker. They will not receive any response to any subsequent IP packets. This approach significantly reduces the load on your server's resources.
The code for our es-nginx-errors filter looks like this:
[Definition]
failregex = ^.* open\(\) ".*\/wp-includes\/wlwmanifest\.xml" failed \(2: No such file or directory\), client: <HOST>
^.* directory index of ".*" is forbidden, client: <HOST>
^.* ".*\/index\.(php|htm).*" is not found \(2: No such file or directory\), client: <HOST>
^.* open\(\) ".*(\.env|\.git|\.auto\.tfvars).*" failed \(2: No such file or directory\), client: <HOST>
^.* open\(\) ".*\.php" failed \(2: No such file or directory\), client: <HOST>
^.*\[crit\] \d+#\d+: \*\d+ SSL_do_handshake\(\) failed \(SSL: error:0A00006C:SSL routines::bad key share\) while SSL handshaking, client: <HOST>
ignorepregex =
In practical use on our Linux servers, this filter has proven to be very effective in suppressing hacker activity within the nginx web server.
The content of this page is also available in Russian.
| © Extra Systems, 2026 |
|