Throttle and then Fail2Ban #210

Activity

1. acegilz commented on Jan 10, 2017

   

   acegilz

   on Jan 10, 2017

   Author

   More actions

   up..
2. courtenay commented on Mar 26, 2017

   

   courtenay

   on Mar 26, 2017

   Last edited by courtenay

   More actions

   in your fail2ban.filter code, check for the throttle key in Rails.cache.read("rack::attack:#{Time.now.to_i / 1.minute}:req/ip:127.0.0.1") - if the count is over a certain amount return true and it'll ban.

   👍React with 👍1Reacted by TJ Saunders
3. feliperaul commented on Jan 16, 2018

   

   feliperaul

   on Jan 16, 2018

   More actions

   @courtenay I like your suggestion, but in this case we should set maxretry to 0 in the Fail2Ban filter, right?
4. grzuy

   added

   type: feature request

   on Mar 8, 2018
5. kruglyjmax commented on Apr 19, 2020

   

   kruglyjmax

   on Apr 19, 2020

   Last edited by kruglyjmax

   More actions

   Solved with using throttled?(req) in Rack::Attack::Fail2Ban.filter with maxretry: 0

   Rack::Attack.throttle('xhr/ip', limit: 10, period: 1.minute) do |req|
     req.path.include?('/api/')
   end
   
   Rack::Attack.blocklist('fail2ban') do |req|
     Rack::Attack::Fail2Ban.filter("xhr/#{req.ip}", maxretry: 0, findtime: 1.minute, bantime: 1.day) do
       throttled?(req) # Counts repeatedly
     end
   end
   
6. dvandersluis commented on Feb 26, 2021

   

   dvandersluis

   on Feb 26, 2021

   More actions

   @kruglyjmax using throttled? seems to doubly increment the throttle (ie. the counter in redis is updated both by the throttle and by the fail2ban). Have you gotten around this?
7. dvandersluis commented on Feb 26, 2021

   

   dvandersluis

   on Feb 26, 2021

   More actions

   I solved my issue by adding a method to Rack::Attack::Throttle:

   def exceeded?(request)
     discriminator = discriminator_for(request)
     return false unless discriminator
   
     current_period = period_for(request)
     current_limit = limit_for(request)
   
     key = [Time.now.to_i / current_period, name, discriminator].join(':')
     count = cache.read(key).to_i
   
     count > current_limit
   end

   And then I can use:

   Rack::Attack::Fail2Ban.filter("throttled/#{req.ip}", maxretry: 10, findtime: 1.minute, bantime: 1.hour) do
     configuration.throttles.any? { |_name, throttle| throttle.exceeded?(req) }
   end
8. grzuy

   closed this as completedon Mar 21, 2021
9. rack

   locked and limited conversation to collaborators on Mar 21, 2021