Enable fail2ban by logging failed requests about karadav HOT 2 CLOSED

Good idea, just two details:

1. X-Forwarded-For should not be trusted by default (or a user could forge a IP), this should be chosen by the user if required, also the header should be configured, some proxies send a different header.
2. This should be logged to a different file, eg. access.log, error.log is for PHP errors.

For example you could add those two constants in config:

/**
* Set to NULL to disable access log
 * @var null|string
 */
const ACCESS_LOG = __DIR__ . '/access.log';

/**
 * Set to the name of the trusted header containing the client IP, if behind a reverse proxy
 * If set to NULL, then the connecting client IP will be used.
 * @var string|null
 */
const TRUSTED_IP_HEADER = 'X-Forwarded-For';

Yes please make a PR, I don't have time to implement this sorry :)

from karadav.

Thanks for the feedback! I was also looking at SFTPGo and noticed that it has already handled some more reverse proxy setups in its configuration:

https://github.com/drakkan/sftpgo/blob/main/docs/full-configuration.md

• proxy_allowed, list of IP addresses and IP ranges allowed to set client IP proxy header such as X-Forwarded-For. Any client IP proxy headers, if set on requests from a connection address not in this list, will be silently ignored. Default: empty.
• client_ip_proxy_header, string. Defines the allowed client IP proxy header such as X-Forwarded-For, X-Real-IP etc. Default: empty
• client_ip_header_depth, integer. Some client IP headers such as X-Forwarded-For can contain multiple IP address, this setting define the position to trust starting from the right. For example if we have: 10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1 and the depth is 0, SFTPGo will use 13.0.0.1 as client IP, if depth is 1, 12.0.0.1 will be used and so on. Default: 0.

I think I will follow this format.

from karadav.