Your IP : 10.10.106.44

Current Path : /proc/thread-self/root/proc/thread-self/root/opt/cpguard/cpglfd/configs/jails.available/
Upload File :
Current File : //proc/thread-self/root/proc/thread-self/root/opt/cpguard/cpglfd/configs/jails.available/http.yaml

jails:
  # 1. Apache / Nginx Authentication Failure
  - name: "http"
    enabled: true
    log_paths:
      - "/var/log/apache2/error.log"
      - "/var/log/httpd/error_log"
      - "/var/log/nginx/error.log"
    
    # 👇 Converted to Rules
    rules:
      # Apache
      - regexp: "\\[client (?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+)\\] (AH01630|AH01797): client denied"
      
      # Nginx
      - regexp: "client: (?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+), server: .*, request:"

    max_retries: 20
    find_time: "1m"
    ban_time: "1h"
    
    actions:
      - name: "cpgblock-http"
        ban_command: '/usr/bin/cpgcli ip --temp-block {{.IP}} --reason "Blocked by {{.JailName}} due to more than {{.MaxRetry}} abusive access within {{.FindTime}} seconds" --extra " LogFile: {{.LogPath}} | Reason: {{.LogLine}}"'
        unban_command: "/usr/bin/cpgcli ip --temp-block {{.IP}} --remove"

  # 2. WordPress / CMS Brute Force
  - name: "http-cms-bots"
    enabled: true
    log_paths:
      - "/etc/apache2/logs/domlogs/*/*"
      - "/var/log/nginx/access.log"
      - "/var/log/httpd/domains/*.log"
      - "/usr/local/apache/domlogs/*.log"
      - "/var/local/enhance/webserver_logs/*.log"
      - "/usr/local/lsws/logs/*.*.log"
      - "/usr/local/apps/apache2/logs/*.*.log"
      - "/usr/local/apps/nginx/var/log/*.*.log"
      - "/var/www/vhosts/system/*/logs/access*_log"

    # Ignore legitimate bots to save CPU and prevent false positives
    ignore_strings:
      - "bingbot"
      - "UptimeRobot"
      - "Googlebot"
      - "facebookexternalhit"
      - "ChatGPT-User"
      - "AdsBot-Google"
      - "Google-Adwords"
      - "Jetpack"
      - "admin-ajax.php"

    
    # 👇 Converted to Rules
    rules:
      # case 1: failed attempts to execute PHP scripts
      - regexp: "^\"?(?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+)\"? .*[\" ](GET|POST) .*\\.php.* HTTP/\\d\\.\\d.*[\" ](401|403|404|406)[\" ]"
        max_retries: 15
      
      # case 2: wp-login or xmlrpc Brute Force attack
      - regexp: "^\"?(?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+)\"? .*[\" ](GET|POST) .*(wp-login\\.php|xmlrpc\\.php).*[\" ](200|307)[\" ]"
        max_retries: 10
      
      # case 3: user agent empty, script or bot
      - regexp: "^\"?(?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+)\"? .*\\.php.* \"-\" \"-\"\\s*$"

      # case 4: empty referer and 404 response code without .php file request
      - regexp: "^\"?(?P<ip>\\d+\\.\\d+\\.\\d+\\.\\d+)\"? .* \"GET \\/[^ ]*\\/ HTTP\\/[0-9.]+\" \"?404\"? \\d+ \"-\" .*$"

    max_retries: 15
    find_time: "1m"
    ban_time: "1h" # Ban hard for bots
    
    actions:
      - name: "cpgblock-http"
        ban_command: '/usr/bin/cpgcli ip --temp-block {{.IP}} --reason "Blocked by {{.JailName}} due to more than {{.MaxRetry}} abusive access within {{.FindTime}} seconds" --extra " LogFile: {{.LogPath}} | Reason: {{.LogLine}}"'
        unban_command: "/usr/bin/cpgcli ip --temp-block {{.IP}} --remove"