Skip to content

Instantly share code, notes, and snippets.

@luiseok

luiseok/jail.local

Last active July 24, 2025 16:28
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save luiseok/fb6d43701b17f4d1de5afa4121f21f27 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save luiseok/fb6d43701b17f4d1de5afa4121f21f27 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. luiseok revised this gist Sep 6, 2018. 2 changed files with 2 additions and 2 deletions.
    2 changes: 1 addition & 1 deletion jail.local
    View file
    Original file line number Diff line number Diff line change
    @@ -1,5 +1,5 @@
    #
    # File Path : fail2ban/jail.local
    # File Path : /etc/fail2ban/jail.local
    #
    # Please modify the port and logpath that you configured.
    #
    2 changes: 1 addition & 1 deletion mongo-auth.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -1,5 +1,5 @@
    #
    # File Path : fail2ban/filter.d/mongo-auth.conf
    # File Path : /etc/fail2ban/filter.d/mongo-auth.conf
    #
    # Fail2Ban filter for unsuccesfull MongoDB authentication attempts
    # Tested on fail2ban-client v0.9.3
  2. luiseok revised this gist Feb 4, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion jail.local
    View file
    Original file line number Diff line number Diff line change
    @@ -14,4 +14,4 @@ port = 27017
    banaction = iptables-multiport[name="mongo", port="27017"]

    bantime = 86400
    findtine = 300
    findtime = 300
  3. luiseok revised this gist Aug 14, 2017. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions jail.local
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,6 @@
    #
    # File Path : fail2ban/jail.local
    #
    # Please modify the port and logpath that you configured.
    #

  4. luiseok created this gist Aug 14, 2017.
    15 changes: 15 additions & 0 deletions jail.local
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,15 @@
    #
    # Please modify the port and logpath that you configured.
    #

    [mongo-auth]

    enabled = true
    filter = mongo-auth
    logpath = /var/log/mongodb/mongod.log
    maxretry = 3
    port = 27017
    banaction = iptables-multiport[name="mongo", port="27017"]

    bantime = 86400
    findtine = 300
    30 changes: 30 additions & 0 deletions mongo-auth.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,30 @@
    #
    # File Path : fail2ban/filter.d/mongo-auth.conf
    #
    # Fail2Ban filter for unsuccesfull MongoDB authentication attempts
    # Tested on fail2ban-client v0.9.3
    #

    [INCLUDES]

    # Read common prefixes. If any customizations available -- read them from
    # common.local
    before = common.conf

    [Definition]

    _daemon = mongodb

    failregex = ^.*[aA]uthentication [fF]ail(ed|ure) for \w+ on \w+ from client <HOST>:[0-9].*|$

    ignoreregex =

    # DEV Notes:
    #
    # This file is intended to prevent access to MongoDB with an incorrect account.
    #
    # Example
    # 2017-08-15T07:48:03.291+0900 I ACCESS [conn18] SCRAM-SHA-1 authentication failed for admin on admin from client 192.168.0.7:11696 ; UserNotFound: Could not find user admin@admin
    # 2017-08-15T07:57:17.752+0900 I ACCESS [conn28] SCRAM-SHA-1 authentication failed for luiseok on admin from client 192.168.0.12:53380 ; AuthenticationFailed: SCRAM-SHA-1 authentication failed, storedKey mismatch

    # Author: luiseok (https://github.com/luiseok)