Secure server with Fail2ban and Docker
<p>I use nginx in a docker container and I can easily share my log file on my nginx docker container with host. The log are on it and work on <code>/var/log/nginx</code> folder.</p>

<p>I have install fail2ban on host to check logs files, particulary <code>access.log</code>.</p>

<p>I test a simple filter </p>

<pre><code># Fail2Ban configuration file
# Author: Miniwark

[Definition]
failregex = ^&lt;HOST&gt; .*"GET .*w00tw00t
# try to access to admin directory
            ^&lt;HOST&gt; .*"GET .*admin.* 403
            ^&lt;HOST&gt; .*"GET .*admin.* 404
# try to access to install directory
            ^&lt;HOST&gt; .*"GET .*install.* 404
# try to access to phpmyadmin
            ^&lt;HOST&gt; .*"GET .*dbadmin.* 404
            ^&lt;HOST&gt; .*"GET .*myadmin.* 404
            ^&lt;HOST&gt; .*"GET .*MyAdmin.* 404
            ^&lt;HOST&gt; .*"GET .*mysql.* 404
            ^&lt;HOST&gt; .*"GET .*websql.* 404
            ^&lt;HOST&gt; .*"GET \/pma\/.* 404
# try to access to wordpress (we use another CMS)
            ^&lt;HOST&gt; .*"GET .*wp-content.* 404
            ^&lt;HOST&gt; .*"GET .*wp-login.* 404
# try to access to typo3 (we use another CMS)
            ^&lt;HOST&gt; .*"GET .*typo3.* 404
# try to access to tomcat (we do not use it)      
            ^&lt;HOST&gt; .*"HEAD .*manager.* 404
# try to access various strange scripts and malwares
            ^&lt;HOST&gt; .*"HEAD .*blackcat.* 404
            ^&lt;HOST&gt; .*"HEAD .*sprawdza.php.* 404

ignoreregex = 
</code></pre>

<p>And I active it easily in <code>/etc/fail2ban/jail.local</code></p>

<pre><code>[nginx-nokiddies]
# ban script kiddies
enabled  = true
port     = http,https
filter   = nginx-nokiddies
logpath  = /var/log/nginx*/*access.log
maxretry = 1
</code></pre>

<p>I restart/stop/start/reload fail2ban service. Then I test this regex with </p>

<pre><code>fail2ban-regex /var/log/nginx/access.log /etc/fail2ban/filter.d/nginx-nokiddies.conf
</code></pre>

<p>It match thousands of line, especially with any <em>admin</em> request. </p>

<p>The main problem is fail2ban not working automatically, so doesn't send mail as before. Indeed, it works perfectly  when I use an nginx install directly on host.</p>

<p>The log are in the basic format, call 'combined' formats like this : </p>

<pre><code>log_format combined '$remote_addr - $remote_user [$time_local]  '
            '"$request" $status $body_bytes_sent '
            '"$http_referer" "$http_user_agent"';
</code></pre>

<p>No permissions problem because my nginx container and its children are full permissions (777) to be sure, I change it after of course !</p>

<p>Why fail2ban process not ban ip and not match anything with docker ?</p>