title: Secure server with Fail2ban and Docker
body: <p>I use nginx in a docker container and I can easily share my log file on my nginx docker container with host. The log are on it and work on <code>/var/log/nginx</code> folder.</p>
  
  <p>I have install fail2ban on host to check logs files, particulary <code>access.log</code>.</p>
  
  <p>I test a simple filter </p>
  
  <pre><code># Fail2Ban configuration file
  # Author: Miniwark
  
  [Definition]
  failregex = ^&lt;HOST&gt; .*"GET .*w00tw00t
  # try to access to admin directory
              ^&lt;HOST&gt; .*"GET .*admin.* 403
              ^&lt;HOST&gt; .*"GET .*admin.* 404
  # try to access to install directory
              ^&lt;HOST&gt; .*"GET .*install.* 404
  # try to access to phpmyadmin
              ^&lt;HOST&gt; .*"GET .*dbadmin.* 404
              ^&lt;HOST&gt; .*"GET .*myadmin.* 404
              ^&lt;HOST&gt; .*"GET .*MyAdmin.* 404
              ^&lt;HOST&gt; .*"GET .*mysql.* 404
              ^&lt;HOST&gt; .*"GET .*websql.* 404
              ^&lt;HOST&gt; .*"GET \/pma\/.* 404
  # try to access to wordpress (we use another CMS)
              ^&lt;HOST&gt; .*"GET .*wp-content.* 404
              ^&lt;HOST&gt; .*"GET .*wp-login.* 404
  # try to access to typo3 (we use another CMS)
              ^&lt;HOST&gt; .*"GET .*typo3.* 404
  # try to access to tomcat (we do not use it)      
              ^&lt;HOST&gt; .*"HEAD .*manager.* 404
  # try to access various strange scripts and malwares
              ^&lt;HOST&gt; .*"HEAD .*blackcat.* 404
              ^&lt;HOST&gt; .*"HEAD .*sprawdza.php.* 404
  
  ignoreregex = 
  </code></pre>
  
  <p>And I active it easily in <code>/etc/fail2ban/jail.local</code></p>
  
  <pre><code>[nginx-nokiddies]
  # ban script kiddies
  enabled  = true
  port     = http,https
  filter   = nginx-nokiddies
  logpath  = /var/log/nginx*/*access.log
  maxretry = 1
  </code></pre>
  
  <p>I restart/stop/start/reload fail2ban service. Then I test this regex with </p>
  
  <pre><code>fail2ban-regex /var/log/nginx/access.log /etc/fail2ban/filter.d/nginx-nokiddies.conf
  </code></pre>
  
  <p>It match thousands of line, especially with any <em>admin</em> request. </p>
  
  <p>The main problem is fail2ban not working automatically, so doesn't send mail as before. Indeed, it works perfectly  when I use an nginx install directly on host.</p>
  
  <p>The log are in the basic format, call 'combined' formats like this : </p>
  
  <pre><code>log_format combined '$remote_addr - $remote_user [$time_local]  '
              '"$request" $status $body_bytes_sent '
              '"$http_referer" "$http_user_agent"';
  </code></pre>
  
  <p>No permissions problem because my nginx container and its children are full permissions (777) to be sure, I change it after of course !</p>
  
  <p>Why fail2ban process not ban ip and not match anything with docker ?</p>