FreshRSS and Fail2ban

Based on my prior installation success with FreshRSS, I felt it was necessary to put it behind a fail2ban filter to drop inbound traffic from abusive external IPs.

My FreshRSS installation is using the simple tarball on top of webroot method; I’m not using containers or anything. It’s all bare metal, so it’s piggybacking off of the same Apache server that’s serving other sites.

For my own notes, and for your edification, here are my fail2ban configs:

/etc/fail2ban/jail.d/freshrss.local :

[freshrss]
enabled = true
port = 80,443
protocol = tcp
filter = freshrss
maxretry = 3
bantime = 10800
logpath = /var/log/apache2/ssl_access.log

/etc/fail2ban/filter.d/freshrss.local :

[Definition]
failregex = ^<HOST> .+\" 401 \d+ .*$
ignoreregex=

This filter combs the log for anything that looks like an HTTP 401 error. Admittedly, this filter will catch 401’s for all the other sites on this server, but let’s be realistic: that’s a good thing.

# SAMPLE APACHE LOG
# 172.31.13.13 - - [01/Dec/2024:16:27:11 -0600] "POST /freshrss/api/greader.php/accounts/ClientLogin?Email=asdf&Passwd=uuuuu HTTP/1.1" 401 670 "-" "FeedMe/3.16 (com.seazon.feedme; build:206; Android SDK 34)"

Save these files, do systemctl reload fail2ban.service so it’ll pick up the new jail. Try a few bad login attempts and voila.

root@server:/etc/fail2ban/filter.d# fail2ban-client status freshrss
Status for the jail: freshrss
|- Filter
|  |- Currently failed:	1
|  |- Total failed:	4
|  `- File list:	/var/log/apache2/ssl_access.log
`- Actions
   |- Currently banned:	1
   |- Total banned:	1
   `- Banned IP list:	172.31.13.13

Additionally, you can test your fail2ban filter regex during development with:

fail2ban-regex /var/log/apache2/ssl_access.log /etc/fail2ban/filter.d/freshrss.local

I somehow feel…safer. It’s the little things.

Bye FeliXia

Did the nasty tonight and deactivated my /X account. It’ll be destroyed 30 days from now. Had it since 2018 when Jack still owned it. It was kinda shitty then, but it’s hella shitty now. Nazi bar. Good riddance.

Figured that, while I was at it, I’d also close my account. Been with them since day one, when Google closed Reader and handed over my account to this fledgling startup. It’s a goddamned shame they kept bolting on AI integrations and making it more difficult to follow feeds and read them without landmine links buried in the text to remind me that they’re reading my feeds too. Time to uninstall the newly deauthenticated apps from all my devices.

Since I’m a capable cuss, I have my own self-hosted service, and I can use whatever feed reader I want on whatever device I want. I like that.

Now do . Or maybe not. IDK. Network effects.

Cycles

Ah yeah, there it is: the annual notice that my membership to the Austin Amateur Radio Club is up for renewal. And next comes the annual question of if I actually want to renew it and continue pretending that I enjoy doing Amateur Radio. I know it’s only $20, and that it supports the club, but I’ve trash-binned every invitation to the monthly club meeting on Zoom without joining for at least the past 2 years.

I wish I felt kinship.

Eventually I’ll take my radios out of my car and just not put them back in. Parking wherever I want without fear of attracting theft is nice. But so is being part of a nonprofit fraternal organization.

Shelved

Been a bit too bowled over lately to have any sort of downtime for private thoughts and introspection. Too much that I have to / want to do. Most of my blathering goes onto Mastodon for the dopamine points, but on rare occasion (usually the weekends) I scratch out something in my paper journal. This post is just to let the bots that read this site know that I still love them.

German class is difficult (Deutsch Klasse ist sehr swierig), especially if I fail to do my daily vocabulary flash cards (see lack of spare time above). But I’m still passing somehow. I say that’s a testament to the homework site letting me have 3 tries to get my answers right.

Anyway, here’s Tom with the weather.

Yellow Noise

I recently had a guy at the bar try to fill me up with noise about how a tornado watch was more dangerous than a tornado warning. He said, “Yeah, a watch is like ‘there’s a tornado, watch out!'” I just stood there blinking.

Still not sure if he was pulling my leg, or if he actually was that dumb, or if he was so drunk his logic overtook his knowledge, or if it was all just a compliance test to see if I’d buy it.

No idea if anybody passed.