TECH : Enable haproxy log

TECH : Enable haproxy log

1. at the top of /etc/haproxy/haproxy.cfg

2. global
       log         127.0.0.1 local2
   

   
   
3. in file /etc/rsyslog.conf

4. # Provides UDP syslog reception
   $ModLoad imudp
   $UDPServerRun 514
   $UDPServerAddress 127.0.0.1
   

5. in file  /etc/rsyslog.d/haproxy.conf

6. local2.*     /var/log/haproxy.log
   

   
   
7. restart services
   

   service rsyslog restart
   service haproxy restart
   

Enjoy!

TECH : Block DDOS attack with Cloudflare and haproxy and fail2ban.

Survive DDOS attack with Cloudflare and haproxy and fail2ban.


This configuration tested in live attack of 72 servers with 10,000 requests per  minute

1. Configure Cloudflare for maximum security
1. https://support.cloudflare.com/hc/en-us/articles/200170196-I-am-under-DDoS-attack-what-do-I-do-
2. Enable  haproxy log
1. http://moshez.blogspot.co.il/2016/05/tech-enable-haproxy-log.html
3. Enable custom log for haproxy by changes to /etc/haproxy/haproxy.cfg

frontend  main
 bind *:80
 
 log   global
 capture request header X-Forwarded-For len 25
 log-format %hr[%r]

4. Remove from default section the log global because we move it to frontend  main for more performance
5. configure fail2ban 
1. jail config - /etc/fail2ban/jail.conf
2. 
   

   [haproxy]
   enabled = true
   port    = http,https
   filter  = haproxy
   banaction = cloudflare
   maxretry = 2
   findtime  = 5
   logpath  = /var/log/haproxy.log
   bantime = 7200
   

   
   
3. filter config /etc/fail2ban/filter.d/haproxy.conf
4. this will catch all / requests.
   

   # Fail2Ban filter for haproxy
   # by MosheZ http://moshez.blogspot.com
   
   
   [INCLUDES]
   
   # Read common prefixes. If any customizations available -- read them from
   # common.local
   before = common.conf
   
   [Definition]
   
   _daemon = haproxy
   
   failregex = ^\s.*: {<HOST>}(.*GET / HTTP/1.1.*)\s*$
   
   ignoreregex = 
   
   [Init]
   
   # "maxlines" is number of log lines to buffer for multi-line regex searches
   maxlines = 10
   

5. action config /etc/fail2ban/action.d/cloudflare.conf

6. [Definition]
   
   
   actionban = curl -s -o /dev/null https://www.cloudflare.com/api_json.html -d 'a=ban' -d 'tkn=<cftoken>' -d 'email=<cfuser>' -d 'key=<ip>'
   
   
   #actionunban = curl -s -o /dev/null https://www.cloudflare.com/api_json.html -d 'a=nul' -d 'tkn=<cftoken>' -d 'email=<cfuser>' -d 'key=<ip>'
   
   [Init]
   
   # If you like to use this action with mailing whois lines, you could use the composite action
   # action_cf_mwl predefined in jail.conf, just define in your jail:
   #
   # action = %(action_cf_mwl)s
   # # Your CF account e-mail
   # cfemail  = 
   # # Your CF API Key
   # cfapikey = 
   
   cftoken = dfgb0390bfe31ed1e931c1b6ae (REPLACE THIS)
   
   cfuser = example@example.com (REPLACE THIS)

7. Restart services

   service haproxy restart
   service fail2ban restart

6. 
   
7. Enjoy!