Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

-1
votes
1answer
23 views

How to prevent password bruteforce in web application?

I have php web application (nginx+php-fpm). And someone try to bruteforce password. He have a lot of IPs. Also these bruteforce works like DDOS because each time web application starts and try to ...
0
votes
0answers
12 views

Make Fail2ban parse latest logs generated monthly.

I have a log file generated monthly (e.g messageApril2015.log,messageMay2015.log). Can anyone tell me how to make fail2ban parse the latest log? I have read somewhere about adding %F%Y but it didn't ...
0
votes
0answers
16 views

Bad Referer AND DNS Cache Poisoning [duplicate]

I am annoyed by a lot of bad referer spammers I am seeing in apache's logs. 208.118.126.250 - - [12/May/2015:17:45:06 +0200] "GET /js/parsley.js HTTP/1.1" 200 91434 "http://voiceit.be/logins/login" ...
0
votes
1answer
11 views

Fail2Ban Filter Errors

I'm trying to add two fail2ban filters, one for post flood and phpmyadmin brute force but i get the following errors. logs: fail2ban.filter : ERROR No 'host' group in '[[]client []] File does not ...
0
votes
0answers
25 views

Can't pass Fail2ban banned IP's to CloudFlare in Nginx?

I have Ubuntu 14.04, Nginx 1.6.2, MySQL 10.0.17-MariaDB, PHP 5.5.24 VPS. It running two WordPress sites. I use fail2ban with CSF. Fail2ban I use ban action as route, because iptables-multiport and ...
3
votes
0answers
61 views

How to blacklist or whitelist lots or few ip ranges with ipset and iptables + fail2ban

EDIT: It's astonishing how the urge to find a solution sometimes is sufficient to slowly but steadily lead one towards a solution. Also, the more often I reread my question in order to clarify it, I ...
-2
votes
0answers
11 views

Fail2ban, jail.conf not exist [migrated]

I installed Fail2ban to my debian, but I haven't jail.conf file in /etc/fail2ban/. I have only: action.d, filter.d Where can I find jail.conf?
0
votes
1answer
55 views

fail2ban keeps trying to ban again

I have an issue getting fail2ban to do what I want. I use a action which bans the IP on CLoudFlare, that means that still a lot of requests get through until everything has been updated on ...
0
votes
1answer
35 views

Modify fail2ban failregex to match failed public key authentications via ssh

fail2ban doesn't recognize failed public key ssh logins and I assume that this can be solved by modifying the failregex of /etc/fail2ban/filter.d/sshd.config to match the following line: <date> ...
1
vote
1answer
59 views

Fail2ban critical exception - does not block ips

I'm trying to get fail2ban running on CentOS7 (no SELinux) and it uses firewalld. My goal is to set it to ban Asterisk password fails. Setup was default yum install fail2ban Config-wise I ONLY added ...
1
vote
1answer
43 views

fail2ban says banned, but can still log in

Running fail2ban 0.8.14 on CentOS 6.5 with Python 2.6.6, fail2ban puts my IP in the banned list, but doesn't actually prevent me from logging in. Here's an example of a failed ban in ...
0
votes
1answer
93 views

ipTables IP Range will not be blocked

I have setup fail2ban with this Tutorial http://wireflare.com/permanently-ban-repeat-offenders-with-fail2ban/ and it seems working. But the attackers are changing their IPs and thats why I decided to ...
0
votes
1answer
70 views

Can't connect to Ubuntu VPS via SSH,SFTP

When I try to login to my VPS using SSH and SFTP it's not connect to the server. Then I power off and power on the VPS by the VPS provider control panel (digital ocean). Once it boot up, first few ...
0
votes
1answer
109 views

Regex for multiple sshd Received disconnect from … [preauth]

What fail2ban regex would catch logs like these? Apr 9 08:48:28 server sshd[1856]: Received disconnect from 43.255.190.117: 11: [preauth] Apr 9 09:06:05 server sshd[1936]: Received disconnect ...
0
votes
0answers
19 views

How do I ban IP's that request files that do not exist using fail2ban? [duplicate]

I have recently started using Fail2Ban and need to configure a specific 'Jail'. My apache error logs are filled with requests for files within my /var/www folder. The folder doesn't contain any ...
-3
votes
1answer
25 views

What configuration is necessary for fail2ban to be useful? [closed]

If I simply install fail2ban on my server with sudo apt-get install fail2ban without configuring anything, does this provide adequate protection? It seems that fail2ban comes with 1-2 pages of jails ...
2
votes
0answers
41 views

“Centralized” fail2ban only banning attacks to local host

I'm trying to run fail2ban on the rsyslog server that gathers auth logs from the rest of our servers. I'm interested on getting notifications working as a first step. My problem is that fail2ban only ...
0
votes
1answer
64 views

Loading fail2ban rules to iptables using iptables-persistent

I am using iptables-persistent package to reload my iptables on boot. And I have been thinking should I add the fail2ban rules to the loaded config file? Now I am seeing they are duplicated. This is ...
0
votes
1answer
30 views

Cannot understand this example fail2ban rule

I'm trying to secure my admin and user login page from brute force attacks. I have setup iptables and the closest thing I can find which looks useful is this: jail file: [nginx-login] enabled = true ...
-1
votes
1answer
27 views

fail2ban identify the subscription specific error log which resulted in an IP ban [closed]

I am running Fail2Ban via Parallels Plesk 12.x on several CentOS 6 containers with several active jails (apache-noscripts, plesk-apache etc.). The Fail2Ban.log provides the IP address which was ...
0
votes
0answers
63 views

prevent phpbb bruteforcing with mod_security

Update: I edited this and added a fail2ban tag. Perhaps that might be another way to handle this issue. I'm running phpbb 3.0.13-PL1 and I would like to protect the login page from bruteforcing. I'm ...
0
votes
0answers
34 views

fail2ban WARNING invalid command on apache2 disabled websites

I have a problem on a Debian Squeezy webserver running fail2ban. Now and then, fail2ban stops working complaining of missing access.log: fail2ban.comm : WARNING Invalid command: ['set', ...
0
votes
1answer
67 views

Setup fail2ban with apf

Along with BFD we have recently installed fail2ban on our server, it is CentOS and it uses APF to block IPs. I have hunted online on how to get the two to work however when an IP is blocked by ...
1
vote
1answer
191 views

Fail2ban configuration for nginx using firewallcmd in CentOS 7

Previously I have a CentOS 6.5 with Iptables and I configure some jails for nginx as suggested here: How To use fail2ban for Nginx?. But now I am in CentOS 7, trying to use the new firewall and ...
1
vote
0answers
74 views

What this error means on Fail2ban?

I've installed fail2ban on my server. Anyway, I've seen this error on Fail2ban Log... What does it means? Here's the error 2015-02-09 06:11:21,076 fail2ban.filter [23563]: INFO ...
1
vote
1answer
171 views

How to interpret postfix logs on Ubuntu

I just installed postfix on my server which runs Ubuntu 14.04.1 LTS. I am a little confused as to how I should interpret the postfix logs located at /var/log/mail.log. Firstly, one of the reasons I ...
0
votes
1answer
355 views

Fail2ban doesn't start [closed]

I've done some changes to the file /etc/fail2ban/jail.local (a copy of /etc/fail2ban/jail.conf) and saved, but now fail2ban doesn't start. If I erase jail.local, then it start again. So the problem is ...
1
vote
2answers
253 views

fail2ban error on setting iptables on Synology NAS

I setup fail2ban 0.9.1 on my Synology NAS to handle failed SSH attempts. When I startup the jail I get the following errors in fail2ban.log: 2015-02-01 17:22:52,394 fail2ban.jail [30576]: ...
2
votes
1answer
70 views

fail2ban did not ban anything, regardless of the settings

this is the first time that i did not find a solution here. so, hopefully it can be solved. i've installed a fresh, new ubuntu minimal system (14.04) with ssh on it. Right after that i installed ...
1
vote
2answers
73 views

Fail2ban maxretry meaning

I'm reading the following page to set up fail2ban on my Ubuntu server: https://help.ubuntu.com/community/Fail2ban In the "Configuration" section, it shows the following settings: [DEFAULT] # ...
1
vote
0answers
117 views

Apache blocking based on combination of ip, request and useragent - Can fail2ban do that?

3 times over the past 48 hours, we had about a 6X spike in traffic lasting a few hours. The server handled it each time, but just barely. This was almost all bad-bot traffic (or maybe failed DOS ...
2
votes
1answer
41 views

What is the purpose of the _daemon directive in fail2ban?

A number of the filters that come with fail2ban have a _daemon directive, but there is no mention of it in the documentation and no reference to it in any of my jail definitions. What's it for?
1
vote
1answer
206 views

Fail2ban on centos 7 does not add rule to firewall. Firewall-cmd used on system

I installed the latest fail2ban from centos/epel I have added the ssh enabled option in jail.local. I have tried with action and banaction = firewallcmd-ipset neither made any difference. ...
0
votes
1answer
96 views

Fail2ban detects attempts from permanently banned IPs

I have a VM with a custom firewall script and Fail2ban. I've identified some IP ranges that make permanent intrusion attempts so I blocked them directly in my firewall script. Here is a simplified ...
3
votes
1answer
438 views

How do I automatically ban udp short packet with fail2ban?

This logfile /var/log/kern.log contains some IP addresses, which I would like the system to automatically ban/block. Basicaly, a packet is from the UDP protocol, and is a short packet, then I would ...
0
votes
1answer
145 views

Configuring varnish to write an apache error log with IP addresses

I am in the process of installing fail2ban on a webserver which runs Varnish. Many on the 'jails' require access to the apache/php error logs. One of the problems I have is that all of the refernces ...
0
votes
2answers
48 views

Massive blockingof ips done right

I run a website which is being abused every day with bots trying to send spam, not respecting robots.txt and so on. The biggest problem, however is repeating attempts to massively harvest website. ...
0
votes
0answers
49 views

Fail2ban apache-myadmin regex

I've got a jail set up with the following regex, which I took from a standard filter file: apache-myadmin.conf failregex = ^[[]client <HOST>[]] File does not exist: *myadmin* *\s*$ ...
0
votes
1answer
88 views

Fail2Ban: I'm having trouble creating a regex for my Dovecot filter

I am trying to create a regex filter for my failed Dovecot entries in the maillog file. What I have created is: .*dovecot: auth: sql\(.*,<HOST>\): Password mismatch The target line in the ...
1
vote
2answers
103 views

Use Fail2ban to block proxied dovecot password attempts

I've searched around a great deal with this, but can't manage to come up with a solution. The easiest way of explaining it, is I used to have just 1 email server, now I have 2. The 1st email server ...
-10
votes
3answers
1k views

make fail2ban use public blacklists [closed]

I've been searching high and low for a way to connect fail2ban with blocklist.de (or any other public blacklists, for that matter, as long as fail2ban can report to it). Pretty much every result that ...
1
vote
2answers
62 views

fail2ban with static IP

Is there any point to running fail2ban to protect your SSH connection if you connect from a static IP? As far as I can see having fail2ban running means that you effectively open up port 22 to ...
1
vote
0answers
497 views

Fail2ban not banning IP's

Running a new install of OpenSuse 13.2 (Running rsyslog) My jail.conf file contains: [ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] ...
2
votes
2answers
681 views

Why is fail2ban not banning this attack?

I have fail2ban installed to ban bruteforce attempts on the ssh password. There are business requirements for not disabling password authentication on this machine. fail2ban was installed using the ...
0
votes
1answer
204 views

Writing a fail2ban multiline regex

I've got some troublesome hosts trying it on with an SSH server I run, and I'm trying to ban them using fail2ban. Problem is, I haven't done much work with regexes, and even less with Python regexes. ...
1
vote
0answers
286 views

Fail2Ban Correctly Attempts to Ban IP but IP does not get banned - iptables chain exists but not working

Running on Ubuntu 14.04 Server. So I have fail2ban correctly configured to process /var/log/auth.log for SSH login attempts. Upon 3 failed attempts I see this in the fail2ban log: 2014-11-19 ...
1
vote
1answer
46 views

Debian Fail2ban action.d and filter.d scripts

I have a debian wheezy server on which I use Fail2ban that was loaded with the package installer. I noticed that while the version on my server (0.8.6-3wheezy3) is current, it does not match up with ...
0
votes
1answer
128 views

Fail2ban does not ban any ip-adresses with vsftpd

Fail2ban starts okey. It work with my sshd filter and bans IP-adresses as it should. But with vsftpd it does not register failed logins when I run: fail2ban-client status vsftpd I have tried both ...
1
vote
0answers
96 views

Is fail2ban working?

I recently installed 2 new servers with Centos 7. I have enabled fail2ban with defaults. I have ensured it is running as ps -ax | grep fail2ban yields: 1996 ? S 0:04 /usr/bin/python ...
1
vote
1answer
75 views

Debian port(s) not responding

I am fairly new to servers. I am trying to run a shoutcast server on debian. Shoutcast runs on a default port of 8000. My problem is it will not load when visiting xxx.xxx.xx.xxx:8000. When I log in ...