Use fail2ban to block hosts with repeated request timeouts

[chef.git] / cookbooks / web / recipes / frontend.rb

diff --git a/cookbooks/web/recipes/frontend.rb b/cookbooks/web/recipes/frontend.rb
index f27b029c93fa8df76ec5278656ca899c982a5073..44aa0cd5b22cfdc02ce686c97a147b212e2da363 100644 (file)
--- a/cookbooks/web/recipes/frontend.rb
+++ b/cookbooks/web/recipes/frontend.rb
@@ -21,6 +21,7 @@ node.default[:memcached][:ip_address] = node.internal_ipaddress || "127.0.0.1"
 
 include_recipe "memcached"
 include_recipe "apache"
+include_recipe "fail2ban"
 include_recipe "web::rails"
 include_recipe "web::cgimap"
 
@@ -64,6 +65,16 @@ template "/etc/logrotate.d/apache2" do
   mode "644"
 end
 
+fail2ban_filter "apache-request-timeout" do
+  failregex '^<ADDR> .* "-" 408 .*$'
+end
+
+fail2ban_jail "apache-request-timeout" do
+  filter "apache-request-timeout"
+  logpath "/var/log/apache2/access.log"
+  ports [80, 443]
+end
+
 if %w[database_offline database_readonly].include?(node[:web][:status])
   service "rails-jobs@mailers" do
     action :stop