Fail2Ban New Rule Needed
Budget: $30 – $250 USD
I want to do this with Fail2ban.
When more than two DIFFERENT usernames are attempted from the same IP address, Fail2ban should kick in and block the attempts. Remember, it should block attempts with more than two DIFFERENT usernames from the SAME IP ADDRESS. It can allow multiple attempts of the same username from the same IP address, but it shouldn't allow MORE THAN two DIFFERENT usernames from the SAME IP address. I provided an example from my log file below.
8.8.8.8 - - [30/Sep/2023:20:13:32 +0000] "GET /player_api.php?username=testusername&password=testpassword&type=m3u HTTP/1.1" 200 24 "-" "Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2721 Mobile Safari/533.3"
When more than two DIFFERENT usernames are attempted from the same IP address, Fail2ban should kick in and block the attempts. Remember, it should block attempts with more than two DIFFERENT usernames from the SAME IP ADDRESS. It can allow multiple attempts of the same username from the same IP address, but it shouldn't allow MORE THAN two DIFFERENT usernames from the SAME IP address. I provided an example from my log file below.
8.8.8.8 - - [30/Sep/2023:20:13:32 +0000] "GET /player_api.php?username=testusername&password=testpassword&type=m3u HTTP/1.1" 200 24 "-" "Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2721 Mobile Safari/533.3"