starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Enhancement]: Support for Fail2Ban with reverse proxy #764

New Issue
Closed
opened 2026-04-24 23:20:34 +02:00 by adam · 6 comments
adam commented 2026-04-24 23:20:34 +02:00
Owner
Copy Link
Copy Source

Originally created by @hschweden on GitHub (Nov 17, 2022).

Describe the feature/enhancement

My server runs behind a reverse proxy with encryption. If someone enters the wrong password multiple times, the IP of the reverse proxy is blocked and logged and all other users can no longer log in. Such a block is also not possible with Fail2Ban. It would be nice if please the IP address of the correct source from the HTTP header (Forwarded field) would be in the log. That would be very helpful.
But big thanks, a very good usable software!

Originally created by @hschweden on GitHub (Nov 17, 2022). ### Describe the feature/enhancement My server runs behind a reverse proxy with encryption. If someone enters the wrong password multiple times, the IP of the reverse proxy is blocked and logged and all other users can no longer log in. Such a block is also not possible with Fail2Ban. It would be nice if please the IP address of the correct source from the HTTP header (Forwarded field) would be in the log. That would be very helpful. But big thanks, a very good usable software!
adam added the enhancement label 2026-04-24 23:20:34 +02:00
adam closed this issue 2026-04-24 23:20:34 +02:00
adam commented 2026-04-24 23:20:35 +02:00
Author
Owner
Copy Link
Copy Source

@advplyr commented on GitHub (Nov 18, 2022):

I haven't used Fail2Ban so I'm not sure what it is looking for in the logs but I added the IP address to the logs like this:

[2022-11-17 18:03:28]  WARN: [Auth] Failed login attempt 6 of 10 from 127.0.0.1
[2022-11-17 18:03:30]  WARN: [Auth] Failed login attempt 7 of 10 from 127.0.0.1
[2022-11-17 18:03:32]  WARN: [Auth] Failed login attempt 8 of 10 from 127.0.0.1
[2022-11-17 18:03:32] ERROR: [Auth] Failed login attempt for user test from ip 127.0.0.1. Attempts: 8
@advplyr commented on GitHub (Nov 18, 2022): I haven't used Fail2Ban so I'm not sure what it is looking for in the logs but I added the IP address to the logs like this: ``` [2022-11-17 18:03:28] WARN: [Auth] Failed login attempt 6 of 10 from 127.0.0.1 [2022-11-17 18:03:30] WARN: [Auth] Failed login attempt 7 of 10 from 127.0.0.1 [2022-11-17 18:03:32] WARN: [Auth] Failed login attempt 8 of 10 from 127.0.0.1 [2022-11-17 18:03:32] ERROR: [Auth] Failed login attempt for user test from ip 127.0.0.1. Attempts: 8 ```
adam commented 2026-04-24 23:20:35 +02:00
Author
Owner
Copy Link
Copy Source

@TheMaxik commented on GitHub (Nov 18, 2022):

I think he means that the "X-Forwarded-For"(or similar) Header in the HTTP request IP is not recognized correctly and showing the IP of the reverse proxy instead of the real client ip. I would guess that is a wrong configured reverse proxy but i cant make it work with Nginx Proxy Manager too. I'm using Cloudflare and Nginx. Nginx seems to show my real ip in the access log. But my nginx Proxy get flagged in the ABS log.

@TheMaxik commented on GitHub (Nov 18, 2022): I think he means that the "X-Forwarded-For"(or similar) Header in the HTTP request IP is not recognized correctly and showing the IP of the reverse proxy instead of the real client ip. I would guess that is a wrong configured reverse proxy but i cant make it work with Nginx Proxy Manager too. I'm using Cloudflare and Nginx. Nginx seems to show my real ip in the access log. But my nginx Proxy get flagged in the ABS log.
adam commented 2026-04-24 23:20:36 +02:00
Author
Owner
Copy Link
Copy Source

@advplyr commented on GitHub (Nov 19, 2022):

It would be nice if please the IP address of the correct source from the HTTP header (Forwarded field) would be in the log

In that case what log is being referred to here? What log is Fail2Ban scanning?

@advplyr commented on GitHub (Nov 19, 2022): > It would be nice if please the IP address of the correct source from the HTTP header (Forwarded field) would be in the log In that case what log is being referred to here? What log is Fail2Ban scanning?
adam commented 2026-04-24 23:20:36 +02:00
Author
Owner
Copy Link
Copy Source

@TheMaxik commented on GitHub (Nov 19, 2022):

You can tell Fail2Ban to scan any file. So in best case the ABS log containing the login limit log. Also the ABS log needs to be saved as file (if its not doing this alredy). Maybe even just a "security.log" where all security relevant things like (failed-)logins get stored.

This is an example of my error but i think this is what @hschweden also ment:
External-Client: 190.33.2.3 <- Fictional
Reverse-Proxy: 192.168.0.97
ABS-Instance: 192.168.0.93

Expected behaviour:
[Server] Login rate limit (10) was hit for ip 190.33.2.3

Actual behaviour :
[Server] Login rate limit (10) was hit for ip 192.168.0.97
Nobody can now login

@TheMaxik commented on GitHub (Nov 19, 2022): You can tell Fail2Ban to scan any file. So in best case the ABS log containing the login limit log. Also the ABS log needs to be saved as file (if its not doing this alredy). Maybe even just a "security.log" where all security relevant things like (failed-)logins get stored. This is an example of my error but i think this is what @hschweden also ment: External-Client: 190.33.2.3 <- Fictional Reverse-Proxy: 192.168.0.97 ABS-Instance: 192.168.0.93 Expected behaviour: `[Server] Login rate limit (10) was hit for ip 190.33.2.3` Actual behaviour : `[Server] Login rate limit (10) was hit for ip 192.168.0.97` Nobody can now login
adam commented 2026-04-24 23:20:37 +02:00
Author
Owner
Copy Link
Copy Source

@advplyr commented on GitHub (Nov 19, 2022):

Abs does store log files in /metadata/logs.

I don't understand how Fail2Ban is aware of a login rate limit being hit.

Previously Abs was not logging any ip address so Fail2Ban couldn't have been getting an ip address from Abs. In the update I made for the next release Abs will be logging the ip address from the request for each rate limit log.
The ip address is retrieved from the request using the request-ip package.

@advplyr commented on GitHub (Nov 19, 2022): Abs does store log files in `/metadata/logs`. I don't understand how Fail2Ban is aware of a login rate limit being hit. Previously Abs was not logging any ip address so Fail2Ban couldn't have been getting an ip address from Abs. In the update I made for the next release Abs will be logging the ip address from the request for each rate limit log. The ip address is retrieved from the request using the request-ip package.
adam commented 2026-04-24 23:20:38 +02:00
Author
Owner
Copy Link
Copy Source

@advplyr commented on GitHub (Nov 19, 2022):

The request IP is now in the logs as of v2.2.5

Not sure what else to do here

@advplyr commented on GitHub (Nov 19, 2022): The request IP is now in the logs as of [v2.2.5](https://github.com/advplyr/audiobookshelf/releases/tag/v2.2.5) Not sure what else to do here
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#764
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?