The es-sql-injection module was developed by Extra Systems to protect your server from SQL injection attacks within the fail2ban system. It works by detecting specific activity in the /var/log/nginx/access.log file.
Connecting es-sql-injection to fail2ban is done in the following way:
[es-sql-injection] enabled = true filter = es-sql-injection logpath = /var/log/nginx/access.log action = iptables-allports[name=es-sql-injection, blocktype=DROP, protocol=all]
Please note that this filter blocks all protocols on all ports for the detected attacker, using the DROP method. This turns your host into a complete "black hole" for this particular attacker. They will not receive any response to any subsequent IP packets. This significantly reduces the load on your server's resources.
The code for our filter es-sql-injection looks like this:
[Definition] failregex = ^<HOST> - - \[.*\] "GET /.*%%(2(0|C|B|8)|0(A|9))(AND|SELECT|ORDER|CONCAT|ELT|CHAR|CAST).*HTTP/\d\.\d" (301|200|404) ignoreregex =
In practical use on our Linux servers, this filter has proven to be very effective in suppressing hacker activity.
The content of this page is also available in Russian.
| © Extra Systems, 2026 |
|