[Icecast] OT: ban listeners

[unosonic]

I have been too optimistic it seems...
I've observerd that some log entries in the icecast access log only get 
written when a client disconnects, not when it connects. Is this normal
behaviour? anyway this of course prevents a fail2ban to recognize new 
listeners, since it simply scans the log for some pattern (axios etc.)
within a given time range. Now playing with longer rages... will report.

maybe this axios we see is sort of a song content id scanner? ...
u.


Damian:
> Through my research, I have not been able to clearly determine whether axios is indeed a bot. How were you able to confirm this? Anyway, I managed to keep these at by bay by blocking these “bad bots" in my apache settings (as my icecast is on the same server as my website, behind the apache server to be clear). But would you mind sharing you fail2ban filter and jail.local setting for this particular purpose? I’d love to take a look at how you achieved this.
> 
> db
> 
> > On 14 Feb 2022, at 1:49 am, unosonic <un at aporee.org> wrote:
> > 
> > 
> > hi,
> > 
> > maybe slighly OT, but I've suffered from quite many bots or whatever 
> > "listeners" staying connected to my server (2.4.4, Debian) permanently, 
> > consuming a lot of bandwidth. Most of them coming from the Google cloud, 
> > /w user agent "axios 0.21.4", among some others. I've created a simple 
> > fail2ban config which bans them for a day on connect. Seems to work...
> > In case someone has similar problems, let me know.
> > 
> > u. 
> > 
> > 
> > _______________________________________________
> > Icecast mailing list
> > Icecast at xiph.org
> > http://lists.xiph.org/mailman/listinfo/icecast
> 
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast