Hi Jean-Philippe
I checked with him, and he IS getting the domain login dialog box when he goes to access the pages.
/var/log/httpd/error_log has 17 entries similar to this one:
[Mon Nov 22 09:01:47.276096 2021] [access_compat:error] [pid 16149] [client xx.xx.xx.xx:52435] AH01797: client denied by server configuration: /home/e-smith/files/ibays/ld_external/html/timekeeper/TaskList.php, referer:
https://mail.logicaldevelopments.com.au/ld_external/timekeeper//var/log/httpd/access_log has entries similar to this one:
logicaldevelopments.com.au xx.xx.xx.xx - ld_external [22/Nov/2021:09:01:47 +0800] "GET /ld_external/timekeeper/TaskList.php?usSeq=xx HTTP/1.1" 200 25124 "
https://mail.logicaldevelopments.com.au/ld_external/timekeeper/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0"
/var/log/fail2ban/daemon.log has entries similar to this:
2021-11-22 09:01:42,888 fail2ban.filter [55395]: INFO [http-auth] Found xx.xx.xx.xx - 2021-11-22 09:01:42
2021-11-22 09:01:42,893 fail2ban.filter [55395]: INFO [http-auth] Found xx.xx.xx.xx - 2021-11-22 09:01:42
2021-11-22 09:01:47,237 fail2ban.filter [55395]: INFO [http-auth] Found xx.xx.xx.xx - 2021-11-22 09:01:47
2021-11-22 09:01:47,279 fail2ban.filter [55395]: INFO [http-auth] Found xx.xx.xx.xx - 2021-11-22 09:01:47
2021-11-22 09:01:47,538 fail2ban.actions [55395]: NOTICE [http-auth] Ban xx.xx.xx.xx
2021-11-22 09:01:47,565 fail2ban.filter [55395]: INFO [recidive] Found xx.xx.xx.xx - 2021-11-22 09:01:47
For now, he logs in via VPN so he can access the services, but we have a number of clients who also access our issue tracking system in a similar way in the same iBay - they haven't reported any issues yet but that could also mean that they haven't tried.