eksiscloud

Fail2ban
check process fail2ban with pidfile /var/run/fail2ban/fail2ban.pid
  group services
  start program = "/etc/init.d/fail2ban force-start"
  stop  program = "/etc/init.d/fail2ban stop || :"
  if failed unixsocket /var/run/fail2ban/fail2ban.sock then restart
  if 5 restarts within 5 cycles then timeout

check file fail2ban_log with path /var/log/fail2ban.log
    if match "ERROR|WARNING" then alert

eksiscloud

# Redis
check host redis.host with address 127.0.0.1
      if failed port 6379 protocol redis then alert

check process redis-server with pidfile "/var/run/redis/redis-server.pid"
    start program = "/etc/init.d/redis-server start"
    stop program = "/etc/init.d/redis-server stop"
    if failed host 127.0.0.1 port 6379 then restart
	if totalmem > 100 Mb then alert
     if children > 255 for 5 cycles then stop

eksiscloud

# PHP-FPM
check process php7.3-fpm with pidfile /var/run/php/php7.3-fpm.pid
    start program = "/usr/sbin/service php7.3-fpm start" with timeout 60 seconds
    stop program  = "/usr/sbin/service php7.3-fpm stop"
    if failed unixsocket /var/run/php/php7.3-fpm.sock then restart
   if 2 restarts within 2 cycles then timeout

eksiscloud

 check process mysqld with pidfile /var/run/mysqld/mysqld.pid
   group database
   group mysql
   start program = "/etc/init.d/mysql start"
   stop  program = "/etc/init.d/mysql stop"
   if failed host localhost port 3306 protocol mysql with timeout 15 seconds for 3 times within 4 cycles then restart
   if failed unixsocket /var/run/mysqld/mysqld.sock protocol mysql for 3 times within 4 cycles then restart
   if 5 restarts with 5 cycles then timeout
   depend mysql_bin
   depend mysql_rc

eksiscloud

#Apache2
check process apache with pidfile /var/run/apache2/apache2.pid
 group www
 start program = "/usr/sbin/service apache2 start"
 stop program = "/usr/sbin/service apache2 stop"

 if cpu is greater than 60% for 2 cycles then alert
 if cpu > 80% for 5 cycles then restart
 if totalmem > 2 GB for 5 cycles then restart
 if children > 250 then restart

eksiscloud

# Varnish
check program varnishpanic with path "/bin/varnishadm panic.show"
       if status != 1 then alert

check process varnish with pidfile /var/run/varnish.pid
     #start program = "/etc/init.d/varnish start" with timeout 30 seconds
     #stop program = "/etc/init.d/varnish stop"
     start program = "/usr/bin/systemctl start varnish" with timeout 30 seconds
     stop program = "/usr/bin/systemctl stop varnish"
     if failed host 127.0.0.1 port 81 protocol http

eksiscloud

 check process nginx with pidfile /var/run/nginx.pid
   group www
   group nginx
   start program = "/etc/init.d/nginx start"
   stop program = "/etc/init.d/nginx stop"
#  if failed port 80 protocol http request "/" then restart  ; I'm redirecting to 443 in Nginx, so no need to monitor
   if 5 restarts with 5 cycles then timeout
   depend nginx_bin
   depend nginx_rc

eksiscloud

User-agent: AffiliateLabz
User-agent: AhrefsBot
User-agent: AspiegelBot
User-agent: coccocbot
User-agent: IAS crawler
User-agent: MJ12bot
User-agent: seewithkids.com
User-agent: SemrushBot/6~bl
User-agent: TTD-Content
User-agent: YandexBot

eksiscloud

map $http_user_agent $bad_bot {
	default								0;
		# libraries etc.
	"~*(?:\b)aiohttp(?:\b)"						1;
	"~*(?:\b)akka-http/(?:\b)"					1;		# 			- done
	"~*(?:\b)Amazon CloudFront(?:\b)"				1;		#			- done
	"~*(?:\b)Facebot Twitterbot(?:\b)"				1;
	"~*(?:\b)check_http/(?:\b)"					1;
	"~*(?:\b)curl/(?:\b)"						1;
	"~*(?:\b)Java/(?:\b)"						1;

eksiscloud

## in the server block
#
# note: if you have posts with title matching these, turn them off or fine-tune
# them to exclude those

## Block SQL injections
location ~* union.*select.*\( {
    access_log /var/log/nginx/blocked.log blocked;
    deny all;
}