The es-ocis module was developed by Extra Systems to protect the ownCloud cloud storage system (ownCloud Infinite Scale, abbreviated as oCIS) from malicious activity within the fail2ban system. Its core functionality lies in identifying suspicious activity in the /var/log/nginx/ocis_access.log file, defined in the nginx configuration for the corresponding host:
server {
server_name ***; # Your domain
# Enable large file uploads by removing size limits
client_max_body_size 0;
proxy_buffering off;
proxy_request_buffering off;
proxy_cache off;
access_log /var/log/nginx/ocis_access.log;
error_log /var/log/nginx/ocis_error.log;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
proxy_connect_timeout 75s;
location /ocs/v2.php/apps/notifications/api/v1/notifications/sse {
proxy_pass http://192.168.0.8:9200;
proxy_read_timeout 86400s;
proxy_send_timeout 86400s;
}
location / {
proxy_pass http://192.168.0.8:9200; # Internal IP of oCIS
proxy_read_timeout 300s;
proxy_send_timeout 300s;
}
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/***/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/***/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = ***) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80;
server_name ***;
return 404; # managed by Certbot
}
It's easy to see that in our case, the ownCloud system runs not on the gateway itself (where nginx is installed), but on a separate internal host on the local network. With this configuration, the nginx server operates as a pure proxy, and all actual request processing occurs on the other host, where ownCloud is installed.
Connecting es-ocis to fail2ban is done in the following way:
[es-ocis] enabled = true filter = es-ocis logpath = /var/log/nginx/ocis_access.log action = iptables-allports[name=es-ocis, blocktype=DROP, protocol=all]
Please note that this filter blocks all protocols on all ports for the detected attacker, using the DROP method. This turns your host into a complete "black hole" for this particular attacker. They will not receive any response to any subsequent IP packets. This significantly reduces the load on your server's resources.
The code for our filter es-ocis looks like this:
[Definition]
failregex = ^<HOST> - - \[.*\] "GET /\.(?!well-known)
^<HOST> - - \[.*\] "GET /[^"]*wp-includes
^<HOST> - - \[.*\] "POST /signin/v1/identifier/_/logon HTTP/\d\.\d" 204 0
ignoreregex =
The line below apparently requires some clarification:
POST /signin/v1/identifier/_/logon HTTP/\d\.\d" 204 0
The fact is, during our testing, we discovered that this exact fragment appears in the nginx server logs when an incorrect password is entered into oCIS. That's why we included it in our filter—specifically to protect our system from brute-force password attacks by the hacker community.
In practical use on our Linux servers, this filter has proven highly effective in suppressing malicious activity when organizing cloud storage systems on the ownCloud platform.
The content of this page is also available in Russian.
| © Extra Systems, 2026 |
|