[Icecast] OT: ban listeners

[Albert Santoni]

On Mon, Feb 14, 2022 at 3:37 AM unosonic <un at aporee.org> wrote:

>
>
> I have been too optimistic it seems...
> I've observerd that some log entries in the icecast access log only get
> written when a client disconnects, not when it connects. Is this normal
> behaviour? anyway this of course prevents a fail2ban to recognize new
> listeners, since it simply scans the log for some pattern (axios etc.)
> within a given time range. Now playing with longer rages... will report.
>
>
Yes, this is normal behaviour, and most webservers like Apache and nginx
behave the same way. Icecast writes to the access log when the connection
is closed so it can log how long the connection was. Tthe last number on a
log line is the session duration in seconds.



> maybe this axios we see is sort of a song content id scanner? ...
> u.
>

Yes, this is a possibility too.

Albert




>
>
> Damian:
> > Through my research, I have not been able to clearly determine whether
> axios is indeed a bot. How were you able to confirm this? Anyway, I managed
> to keep these at by bay by blocking these “bad bots" in my apache settings
> (as my icecast is on the same server as my website, behind the apache
> server to be clear). But would you mind sharing you fail2ban filter and
> jail.local setting for this particular purpose? I’d love to take a look at
> how you achieved this.
> >
> > db
> >
> > > On 14 Feb 2022, at 1:49 am, unosonic <un at aporee.org> wrote:
> > >
> > >
> > > hi,
> > >
> > > maybe slighly OT, but I've suffered from quite many bots or whatever
> > > "listeners" staying connected to my server (2.4.4, Debian)
> permanently,
> > > consuming a lot of bandwidth. Most of them coming from the Google
> cloud,
> > > /w user agent "axios 0.21.4", among some others. I've created a simple
> > > fail2ban config which bans them for a day on connect. Seems to work...
> > > In case someone has similar problems, let me know.
> > >
> > > u.
> > >
> > >
> > > _______________________________________________
> > > Icecast mailing list
> > > Icecast at xiph.org
> > > http://lists.xiph.org/mailman/listinfo/icecast
> >
> > _______________________________________________
> > Icecast mailing list
> > Icecast at xiph.org
> > http://lists.xiph.org/mailman/listinfo/icecast
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast
>


-- 
Albert Santoni
Founder, Radio Mast | Oscillicious
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xiph.org/pipermail/icecast/attachments/20220214/72b5762d/attachment.htm>