{"id":13844141,"url":"https://github.com/atnetws/fail2ban-log4j","last_synced_at":"2025-07-11T22:30:38.945Z","repository":{"id":45126890,"uuid":"437687048","full_name":"atnetws/fail2ban-log4j","owner":"atnetws","description":"fail2ban filter that catches attacks againts log4j CVE-2021-44228","archived":false,"fork":false,"pushed_at":"2022-01-06T20:00:17.000Z","size":24,"stargazers_count":8,"open_issues_count":1,"forks_count":2,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-02-11T21:17:43.525Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/atnetws.png","metadata":{"files":{"readme":"README.md","changelog":"Changelog","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-12-13T00:14:31.000Z","updated_at":"2024-02-11T21:17:43.525Z","dependencies_parsed_at":"2022-09-10T08:11:26.707Z","dependency_job_id":null,"html_url":"https://github.com/atnetws/fail2ban-log4j","commit_stats":null,"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/atnetws%2Ffail2ban-log4j","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/atnetws%2Ffail2ban-log4j/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/atnetws%2Ffail2ban-log4j/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/atnetws%2Ffail2ban-log4j/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/atnetws","download_url":"https://codeload.github.com/atnetws/fail2ban-log4j/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225763254,"owners_count":17520425,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:02:35.724Z","updated_at":"2024-11-21T16:30:37.448Z","avatar_url":"https://github.com/atnetws.png","language":null,"funding_links":["https://www.buymeacoffee.com/atnetws)?"],"categories":["Others"],"sub_categories":[],"readme":"# fail2ban-log4j\nfail2ban filter that catches attacks against log4j CVE-2021-44228\n\n## Installation\nCopy this file to your fail2ban filter.d directory, which is usually something like  \n/etc/fail2ban/filter.d  \nor similar.  \n\nAdd an apache-jndi section to your jail.local or jail.conf:  \n\n```\n[apache-jndi]\nenabled = true\nfilter = apache-jndi\nport = http,https\nlogpath = /var/log/apache2/access.log\nbantime = 86400\nmaxretry = 1\n```\n\nIn case you need to monitor multiple sites, wildcards may help:  \n\n```\n[apache-jndi]\nenabled = true\nfilter = apache-jndi\nport = http,https\nlogpath = /var/www/*/logs/access.log\nbantime = 86400\nmaxretry = 1\n```\n\nLogpath for LAMP servers managed by ispConfig:\n\n```\nlogpath = /var/www/clients/client*/web*/log/access.log\n```\n\nThese are examples assuming\n- A single try reveals that they're a bad guy\n- You only want to block further http(s) traffic. Of course, you might as well block any other ports, too.\n\n\n### Effectiveness  \n\nAs of now, this regex catches jndi:ldap requests that contain \"jndi:ldap\" and one obfuscated version using \"lower\".  \nI'll add more as soon as I find them, but feel free to submit suggestions. \n\n#### Does it work?\n\nYes and no. From a technical point of view, it does what it is supposed to to. It detects known formats of log4shell attempts and should at least keep those who don't put too much effort in their scans blocked from your machines. Unfortunately, the possibilities of masking / obfuscating these requests are unlimited, so keeping up with all possible RegEx variants might appear like a cat-and-mouse game.\n\n#### Like this?\n\nIf this saved you some time, why not [Buy me a coffee](https://www.buymeacoffee.com/atnetws)? ;)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fatnetws%2Ffail2ban-log4j","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fatnetws%2Ffail2ban-log4j","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fatnetws%2Ffail2ban-log4j/lists"}