Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

2
votes
1answer
16 views

fail2ban auto ban ip

I have a problem that i need some help with, This logfile /var/log/kernel.log have some ips that i want the system automatic to ban. if UDP: Short packet: From then i want them to be banned by ...
0
votes
1answer
26 views

Configuring varnish to write an apache error log with IP addresses

I am in the process of installing fail2ban on a webserver which runs Varnish. Many on the 'jails' require access to the apache/php error logs. One of the problems I have is that all of the refernces ...
0
votes
2answers
27 views

Massive blockingof ips done right

I run a website which is being abused every day with bots trying to send spam, not respecting robots.txt and so on. The biggest problem, however is repeating attempts to massively harvest website. ...
0
votes
0answers
5 views

Fail2ban apache-myadmin regex

I've got a jail set up with the following regex, which I took from a standard filter file: apache-myadmin.conf failregex = ^[[]client <HOST>[]] File does not exist: *myadmin* *\s*$ ...
0
votes
1answer
25 views

Fail2Ban: I'm having trouble creating a regex for my Dovecot filter

I am trying to create a regex filter for my failed Dovecot entries in the maillog file. What I have created is: .*dovecot: auth: sql\(.*,<HOST>\): Password mismatch The target line in the ...
0
votes
2answers
57 views

Use Fail2ban to block proxied dovecot password attempts

I've searched around a great deal with this, but can't manage to come up with a solution. The easiest way of explaining it, is I used to have just 1 email server, now I have 2. The 1st email server ...
-4
votes
1answer
68 views

make fail2ban use public blacklists

I've been searching high and low for a way to connect fail2ban with blocklist.de (or any other public blacklists, for that matter, as long as fail2ban can report to it). Pretty much every result that ...
1
vote
2answers
33 views

fail2ban with static IP

Is there any point to running fail2ban to protect your SSH connection if you connect from a static IP? As far as I can see having fail2ban running means that you effectively open up port 22 to ...
0
votes
0answers
114 views

Fail2ban not banning IP's

Running a new install of OpenSuse 13.2 (Running rsyslog) My jail.conf file contains: [ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] ...
1
vote
1answer
102 views

Why is fail2ban not banning this attack?

I have fail2ban installed to ban bruteforce attempts on the ssh password. There are business requirements for not disabling password authentication on this machine. fail2ban was installed using the ...
0
votes
0answers
20 views

Writing a fail2ban multiline regex

I've got some troublesome hosts trying it on with an SSH server I run, and I'm trying to ban them using fail2ban. Problem is, I haven't done much work with regexes, and even less with Python regexes. ...
0
votes
0answers
39 views

Fail2Ban Correctly Attempts to Ban IP but IP does not get banned - iptables chain exists but not working

Running on Ubuntu 14.04 Server. So I have fail2ban correctly configured to process /var/log/auth.log for SSH login attempts. Upon 3 failed attempts I see this in the fail2ban log: 2014-11-19 ...
1
vote
1answer
14 views

Debian Fail2ban action.d and filter.d scripts

I have a debian wheezy server on which I use Fail2ban that was loaded with the package installer. I noticed that while the version on my server (0.8.6-3wheezy3) is current, it does not match up with ...
0
votes
1answer
58 views

Fail2ban does not ban any ip-adresses with vsftpd

Fail2ban starts okey. It work with my sshd filter and bans IP-adresses as it should. But with vsftpd it does not register failed logins when I run: fail2ban-client status vsftpd I have tried both ...
1
vote
0answers
62 views

Is fail2ban working?

I recently installed 2 new servers with Centos 7. I have enabled fail2ban with defaults. I have ensured it is running as ps -ax | grep fail2ban yields: 1996 ? S 0:04 /usr/bin/python ...
1
vote
1answer
40 views

Debian port(s) not responding

I am fairly new to servers. I am trying to run a shoutcast server on debian. Shoutcast runs on a default port of 8000. My problem is it will not load when visiting xxx.xxx.xx.xxx:8000. When I log in ...
1
vote
1answer
202 views

How to ban Syn Flood Attacks using Fail2Ban?

In my log, I am frequently seeing dropped ips like this: > Oct 30 17:32:24 IPTables Dropped: IN=eth0 OUT= > MAC=04:01:2b:bd:b0:01:4c:96:14:ff:df:f0:08:00 SRC=62.210.94.116 > ...
0
votes
1answer
194 views

Fail2ban MTA=Postfix Setting in Jail Config giving Error

In /etc/fail2ban/jail.local, when I have the MTA setting to Postfix, Fail2Ban is showing an error and is unable to start. [DEFAULT] ignoreip = 127.0.0.1/8 bantime = 1800 ...
0
votes
0answers
37 views

What does Nginx Proxy Filter in Fail2ban really do?

What does Nginx Proxy Filter in Fail2ban really do? I am currently setting up Fail2Ban for Nginx. Almost everywhere I've read, they all have included a setting for [nginx-proxy] proxy filter. From ...
0
votes
1answer
70 views

Fail2ban jail.local vs jail.conf

Does jail.local file act as an override to jail.conf or as a replacement to jail.conf? When I was learning about Fail2Ban from tutorials, most of them usually say either to copy jail.conf to ...
0
votes
1answer
47 views

fail2ban flushing my existing IPTABLES rules

I just implemented fail2ban on a server for testing purposes. I have a BLACKLIST chain which blocks a huge set of CIDR masks that I don't want to reach my server. When fail2ban is triggered by a ...
0
votes
1answer
50 views

Fail2ban not working on Ubuntu 12.04

I'm trying to implement fail2ban on a Ubuntu 12.04 x64 server. I've done the following: apt-get install fail2ban Made a copy of jail.conf in /etc/fail2ban/jail.conf.local here's an excerpt: ...
0
votes
0answers
99 views

fail2ban not banning properly

I set up fail2ban on a cpanel server running CSF. In order to avoid collisions, I removed all filters except common.conf and the one filter I need it for, apache-postflood.conf. My post flood conf is ...
2
votes
0answers
28 views

Blocking bot by multi url pattern with fail2ban

I'm seeing a multi url pattern similar to following lines in nginx logs recently. GET / GET /somepath/ GET /otherpath/ GET / GET /somepath/ GET /otherpath/ ... I'm already using fail2ban for ...
0
votes
3answers
518 views

Fail2Ban on CentOS 6.5 Never Bans

Environment: *CentOS 6.5 *Fail2Ban 0.8.14-1 *date outputs the correct date Behavior: Fail2ban starts successfully, but does not create iptables blocks after bad SSH login attempts. I'm only concerned ...
6
votes
3answers
329 views

Banning IPv6 addresses

I am currently accustomed to using tools like fail2ban to keep unwanted traffic away from my servers by banning IPv4 addresses: too many bad log entries per IP, ban the IP. However when the world ...
0
votes
1answer
264 views

Fail2Ban - Iptables - Set does not exist

I have a very strange problem with fail2ban/iptables. Something is not working right, but I can't figoure out what. I have added this conf & and filter for fail2ban: [wordpress-register] enabled ...
1
vote
1answer
126 views

Trouble with Fail2Ban UFW Portscan Filter

I'm trying to create a filter for fail2ban that recognises port scans in the UFW logs. I've confirmed my ban action is working correctly on other filters and am having trouble creating the correct ...
0
votes
0answers
129 views

How to protect tomcat application - user authentication with fail2ban?

AFAIK tomcat6 does not use Apache std .htaccess auth, but has own user authentication method. My question is: How to protect it against brute force attack with fail2ban ?
0
votes
1answer
79 views

Brute force attacks with server's IP

I am running a Debian wheezy server with fail2ban installed, everything works as expected but recently my own server got banned. I added the server's IP in the exception row and it seems to work, but ...
1
vote
1answer
2k views

fail2ban running on CentOS 7 & getting “ssh connection refused”

Is anyone successfully running fail2ban on CentOS 7 and can tell me how to do it? I tried to install fail2ban with yum install fail2ban and run it (there are no extra rules in iptables -L which seems ...
3
votes
3answers
275 views

Sharing of fail2ban banned IPs

I'm using fail2ban on all servers with publicly visible services and I wonder: Is there an easy way to share banned IPs between hosts I control? Is there a service out there collecting and ...
0
votes
1answer
72 views

Logging 403 Rewrites for Brute Force Attacks

As explained in Wordpress Codec, I want to prevent brute force attacks for wp-login.php via RewritetRule. http://codex.wordpress.org/Brute_Force_Attacks#Deny_Access_to_No_Referrer_Requests Rather ...
0
votes
1answer
70 views

fail2ban block ports rules iptable

I just installed Ubuntu Server 14.04 and don't have much experience with IPtables. I am trying to get a basic setup going where I only accept SSH connections on port 22 and 2222. I actually have that ...
0
votes
2answers
352 views

Fail2Ban is not adding iptables rules

Fail2Ban is not adding iptables rules to block attackers. I'm running CentOS 6.5 (32 bit) Here's what I did: fail2ban was installed via yum using the epel repo I copied jail.conf to jail.local I ...
0
votes
1answer
72 views

SELinux problems running Expect script from fail2ban

I have an Expect script that works fine if I run it manually, but fails when run as an action from Fail2ban. The error message is as follows: spawn /usr/bin/telnet 192.168.242.1 The system has no ...
0
votes
1answer
508 views

fail2ban not working on apache Ubuntu

Nothing happens even though it detects in the logs. It does not block the IP. It works fine forVSFTP but not for apache. Please help. You can see the config and log below. jail.local config file: ...
2
votes
1answer
1k views

fail2ban to block Wordpress brute force attacks on wp-login.php

Is there a way to set up fail to ban to block on IP that hits wp-login too many times? I have tried adding this jail.local: [apache-wp-login] enabled = true action = iptables[name=wplogin, ...
4
votes
2answers
138 views

What is the optimum ban duration of a brute force attack?

I use fail2ban to prevent brute force attacks on my production servers. Fail2ban bans an ip after 5 authentication failure and unbans it after 1 hour with my own configuration. I wonder that what is ...
0
votes
1answer
121 views

SecAst blocking IP's that fail2ban is not

I'm using SecAst on my Asterisk server as well as fail2ban. (Setup as an option as per the SecAst installation guide). I did this to test if SecAst is working right. I planned to remove fail2ban if ...
2
votes
1answer
30 views

Preventing SecAst access from across the network

I have SecAst up and running great, and I realize that any workstation on the network can access the SecAst telnet interface. Is there a way to limit this to only my laptop? I don't want one of the ...
-1
votes
2answers
210 views

Fail2Ban Regex - Joomla / PHP5-FPM

i can't get a regex for fail2ban to work. I want to match the following: [Tue Jun 24 10:22:14.528987 2014] [fcgid:warn] [pid 22526:tid 139757615011584] [client IP:PORT] mod_fcgid: stderr: user admin ...
-1
votes
1answer
117 views

iptables: REJECT not working, but DROP does

I have recently setup a server with fail2ban, and it is mostly working except I am getting errors whenever this command tries to execute: sudo iptables -D fail2ban-ssh -s xxx.xxx.xxx.xxx -j REJECT ...
3
votes
2answers
822 views

Fail2Ban: already banned?

I have Fail2Ban running on my Centos Server. (Config below) In my var/log/messages I noticed something really weird: Jun 19 12:09:32 localhost fail2ban.actions: INFO [postfix] 114.43.245.205 ...
1
vote
4answers
86 views

Securing debain with fail2ban or iptables

I'm looking to secure my server. Initially my first thought was to use iptables but then I also learnt about Fail2ban. I understand that Fail2ban is based on iptables, but it has the advantages of ...
1
vote
2answers
139 views

All nginx access logs from 127.0.0.1 (so can't use fail2ban)

Problem I'm trying to configure fail2ban to block ddos attacks using the chunk shown here. Basically it looks at all requests and if any single IP makes more than 240 requests over 60 seconds it ...
4
votes
3answers
2k views

fail2ban not working on fresh install of ubuntu 14.04, why?

After installing and configuring fail2ban, I tried to login to my server through ssh with a wrong password. After a few attempts, I tried with the correct password with success. So, fail2ban didn't ...
2
votes
1answer
210 views

How does fail2ban 0.9 database storage actually works?

Fail2ban 0.9 introduce database storage to save bans on restart. But I can't find out the actual mechanism of it work. There is dbpurgeage parameter which controls lifetime of old bans, defaults to ...
2
votes
1answer
293 views

How to properly configure fail2ban to ban IP if it is accessing some wrong files

I am trying to configure fail2ban on my test server. I want just to temporary block any script bots that try to probe my site. So everything that has cgi-bin, admin, setup.php and so on. I previously ...
1
vote
2answers
165 views

Fail2ban and X-Forwarded

I am configuring fail2ban on my webservers. My Webservers are behind ELB. so I configured X-forwarded to get the real IP's in Apache Access logs.But unfortunately fail2ban not able scan accesslogs ...