Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

1
vote
1answer
22 views

Rule of fail2ban not working when the request is from the brute force attack

I have a situation where some IP from moldova try everyday discover my basic auth credentials with some type of brute force attack. However I have a rule with fail2ban that should avoid this ...
1
vote
1answer
10 views

CentOS7: Run Fail2Ban on existing log with new regex

I've added some regex rules for sshd and want to ban all users in /var/log/secure that match this regex within the jail rules (3 attempts, 24 hours). But I do not want to wait for them to try again, ...
1
vote
1answer
32 views

Fixing fail2ban regex rule for php-url-fopen filter

I'm fixing default php-url-fopen filter to allow some GET query parameters which I'm using in my system (it's not publicly available, but I would still like to block unnecessary requests). The problem ...
-1
votes
2answers
11 views

What does the FAIL2BAN BadBots block ? Only Authentication related?

I am wondering if fail2ban is used only in order to block IP addresses that are from which there are authentication failures (SSH / HTTP auth. etc) or that it is also used for blocking Bots which ...
0
votes
0answers
17 views

Fail2ban failed: option ignoreip in section DEFAULT already exists

tl;dr Fail2ban behaves differently depending on OS, one throwing an error and one working fine with a duplicate directive. Environment Ubuntu 16.04 Fail2Ban v0.9.3 (what's in the repos as of time ...
0
votes
0answers
21 views

How do I get host's systemd journal to see any systemd-nspawn container's systemd journal?

I have sshd listening on a variety of ports in variety of containers. There's a fail2ban instance deployed on the host. I would like the host's fail2ban instance to be able to follow all container ...
0
votes
0answers
28 views

Fail2ban on CentOS, dovecot filters regex not matching logs

I'm starring at this regex for some time now and it seems perfectly matching lines from my log files but I can't get it to work, not even with modifications. I suspect the problem might be with the ...
0
votes
0answers
50 views

IP not showing in /var/log/secure under rhost

I'm trying to get Fail2Ban to block failed sudo -i commands, but the IP is not showing up in the logs. For example when I log into the server with: ssh -i ~/.ssh/id_rsa USER@1.2.3.4 I then use: ...
0
votes
0answers
62 views

Fail2ban 0.9.3 not working on centos7.2

I'm really struggling with this. The default [sshd] jail works fine. Status for the jail: sshd |- Filter | |- Currently failed: 0 | |- Total failed: 0 | `- File list: /var/log/secure `- Actions ...
0
votes
0answers
47 views

Fail2ban error 'database is locked' when trying to start / restart it

I am currently reinstalling fail2ban to have a fresh version, because i've modified it quite a lot of time since I installed it for the first time, and I wanted to default settings for it. Once ...
0
votes
2answers
33 views

fail2ban - virtual host specific

Is it possible to set up fail2ban to ban ip addresses only for certain virtualhost? For example I have a filter that detects various attempts to run *.php file inside website structure. Which I would ...
0
votes
0answers
11 views

activate geoip settings when certain locations detected

I have a website that is attacked from time to time by ddos attackers. Such attack can disable the webpage for days. The webpage serves for few countries so if I know about the attack, the solution is ...
0
votes
0answers
11 views

fail2ban is interpolating invalid brackets for jail name

I have a fail2ban action with an actioncheck definition like so: actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name> This is part of a repeat offenders script I found, and ...
1
vote
1answer
39 views

Fail2ban not respecting email settings

In Fail2ban I have set up my email settings as: # Destination email address used solely for the interpolations in # jail.{conf,local} configuration files. destemail = me@hotmail.com # # Name of the ...
0
votes
0answers
26 views

fail2ban jail not working

I am struggling to get a single jail working in fail2ban. Fail2ban seems functional, and other jails are working. I have tried using fail2ban-regexp and it seems to be matching multiple times, but ...
0
votes
1answer
45 views

fail2ban apache-badbots not blocking IP

I'm trying to get fail2ban to block certain bad bots from hammering my website. I started off with just enabling the default "apache-badbots" in jail.local (I did change the logpath to match my own ...
1
vote
1answer
27 views

how to configure `sshd_config` so fail2ban can see bots

I've updated my sshd_config to be more strict against bots. namely: only keys are allowed, except for a few specified users on specific ips MaxAuthTries = 1 no root login This has been both good ...
1
vote
1answer
128 views

I'm trying to catch brute force against /xmlrpc.php with fail2ban

I'm getting a ton of failed a ton of failed access: 185.103.252.174 - - [28/Apr/2016:15:09:16 -0400] "POST /xmlrpc.php HTTP/1.1" 499 0 "-" "Googlebot/2.1 (+http://www.google.com/bot.html)" 173.246.56....
0
votes
0answers
26 views

Can fail2ban detect and block IP-ranges?

Every day I get hundreds of this lines in my mail.log: Apr 28 11:10:28 servername amavis[30077]: (30077-08) Blocked SPAM {DiscardedInbound,Quarantined}, [185.140.110.16] <xxx@yyy.com> -> <...
0
votes
0answers
34 views

Having trouble getting correct information from Motion camera streaming server for fail2ban

I have a camera running a Motion streaming server, which uses simple HTTP md5 authentication, tunneled through stunnel on the server side. I'm using like to have fail2ban limit requests just for ...
1
vote
1answer
50 views

fail2ban: regex to block \x00 requests?

Every once in a while my server goes down, and when I check my nginx logs, I usually see something like this: 78.37.54.31 - - [20/Apr/2016:20:58:51 +0300] "\x00\x00\x00TZ\x00\x00\x00\x00\x00\x00\x00\...
2
votes
3answers
105 views

Do AWS Servers need fail2ban?

I saw that while I was creating my AWS instance I opted for only my IP address being able to access my server. Also There is a RSA key that is configured for you. In this case do I really need ...
1
vote
1answer
35 views

Fail2ban logging correct ip on Varnish but still not locked out

I am trying to configurefail2ban to ban bad WordPress login attempts, but I'm not having much success. I am using WP fail2ban 3.0.0, which correctly logs bad login attempts on /var/log/secure, as far ...
-1
votes
1answer
48 views

Which Nginx log file is for fail2ban?

I have files in /var/log/nginx/ the log file /var/log/nginx/access.log is empty. But the /var/log/nginx/access.log.1 is being appended as always. In file /etc/fail2ban/fail2ban.conf, logtarget = /...
0
votes
0answers
36 views

Fail2Ban WordPress filter not working on Debian VPS

I am having trouble getting WordPress Fail2Ban filter to work. I have installed the WP Fail2Ban plugin using the latest update which had a few changes, however, nothing is getting blocked. Here is a ...
0
votes
1answer
34 views

Fail2Ban login filter not working on Debian Web Server

So I am having issues getting Fail2Ban to work with as a custom filter for a web app login. First of all, other filter do work such as NGINX Auth. However, my emails have stopped working, not sure why ...
1
vote
1answer
48 views

Allow winscp/filezilla through iptables and fail2ban

I just launched a website within my school community and woke up this morning to logs of someone trying to bruteforce into my server. I followed some guides on digitalocean to set up fail2ban and ...
0
votes
1answer
28 views

sending command to salt from fail2ban

what I'm trying to do is modify my action.d/iptables-allports.conf: actionban = ssh fail2ban@saltmaster.net 'salt '*' iptables.insert position=1 rule='-s <ip> -j DROP -m comment --comment "<...
0
votes
1answer
119 views

Fail2ban compatibility debian debian jessie systemd

Fail2ban debian jessie package not working: On fresh debian jessie with openssh-server (tested in docker container): root@2b29327677c8:/# cat /etc/debian_version 8.3 root@2b29327677c8:/# apt-get ...
0
votes
0answers
43 views

fail2ban regex correctly write

Sorry for my bad english. Server nginx. Block /administrator/ http_access_module nginx-error.log [error] 10934#0: *11435 access forbidden by rule, client: 213.87.x.x, server: localhost, request: "...
0
votes
0answers
31 views

fail2ban error: “WARNING Too much read error. Set the jail idle”

I get this error after a few days and it renders the fail2ban to ignore attacks on the specific filter: 2016-03-11 17:06:35,686 fail2ban.filter : ERROR Unable to get stat on /srv/www/canalbases/logs/...
0
votes
0answers
39 views

Fail2ban fails to start when setting an action

After installing fail2ban and modifying its configuration it fails to start whenever i set the action to anything... here is the error, but note that $(action_mwl)s can will be diferent for any ...
0
votes
0answers
18 views

Fail2Ban bans all ports/protocols instead of specific port(s)

My jail.local: [siplimit-ban] findtime = 300 enabled = true filter = siplimit protocol = udp logpath = /var/log/syslog maxretry = 15 bantime = 3600 port = 5060,5061 And my iptables after ...
0
votes
1answer
104 views

Does fail2ban start automatically each time system starts?

I've just installed Fail2ban on Ubuntu 14.04 and there's something I want to ask: Does fail2ban start automatically each time system starts? I think so, but just want to make sure, since I've read ...
1
vote
1answer
59 views

Fail2ban bans me after sending successful 5 mails

Dear all I am using Fail2Ban v0.8.13 on CentOS 6 system in order to protect my Postfix servers. Basically it works so after 5 wrong login attempts on SMTP I get banned. Fail2Ban Jail conf [sasl-...
0
votes
0answers
22 views

Optimizing log file size on Ubuntu VM

This is a fact-finding question. I'm implementing fail2ban to keep some unscrupulous elements out of my Django website's experience. Note that my webserver is nginx (reverse proxy) with gunicorn as ...
-4
votes
2answers
131 views

Fail2Ban to block IPs that request the same URL repeatedly [duplicate]

Is it possible to use Fail2Ban to block IPs that request the same URL more than 5 times in 10 seconds? I'm not talking about a specific URL, but any random URL of the site that is being requested ...
0
votes
1answer
42 views

phpmyadmin fail2ban failed login log

I have a Debian server with phpmyadmin. I want to use fail2ban to block brute force attack. I have questions: How can I log the failed login attempts to log? Where to set that? I can only find ...
3
votes
1answer
197 views

Should i use Firewalld or Iptables for Fail2ban in Centos 7?

I'm setting up Fail2ban to protect ssh, and I use firewalld, I saw a lot of people recommending to use anaction = iptables-multiport and other solutions using iptables instead of firewalld claiming ...
0
votes
1answer
98 views

Unable to reinstall fail2ban after completly removing it from Centos 7

After completely removing Fail2ban from Centos 7, I decided to reinstall it. So I run the installation(yum), and everything seems ok, no errors, But the it seems like the installation does not create ...
0
votes
0answers
42 views

fail2ban doesnt read log if file being used

My environment is Ubuntu 14.04, LAMP stack all from apt. implemented fail2ban and configured jail.local with backend = auto [ssh] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log ...
1
vote
0answers
72 views

Fail2ban floods and slow response time

I tried searching for this; I found many people asking but I wasn't successfully to find a working (for me) solution. I have an application that logs each connection on a custom log file. When ...
0
votes
0answers
101 views

Issue with Fail2ban and Mikrotik Firewall

OS: CentOS 7.1 At my organization we are currently assessing using Fail2ban with the firewall on our Mikrotik router. I want Fail2ban to communicate any IP flagged as banned to the Mikrotik firewall,...
1
vote
1answer
61 views

Fail2Ban regex is wrong?

I'm currently setting up a filter to filter POST attacks on a file named xmlrpc.php. Requests that should be monitored in the log access look like: 1.99.437.201 - - [01/Feb/2016:01:57:14 +0000] "POST ...
0
votes
0answers
47 views

Nagios check_log reset to OK after notification

Fail2ban is installed on one of the servers, I'm able to ban every IP that try to log in. I'm using the check_log plugin of Nagios to capture the last line of the fail2ban.log, it compares to the ...
0
votes
2answers
754 views

How to check if firewalld is blocking an incoming ip address?

I have CentOS 7 with firewalld. I installed fail2ban and using the firewallcmd-new action. I am seeing bans in the fail2ban logs, and I want to check in firewallcmd if they are blocked. How can I do ...
0
votes
1answer
119 views

why fail2ban does not ban? (ubuntu, ssh)

I installed a fresh Ubuntu machine. Then I changed the ssh port which is no more 22 but 22111: Then I have installed fail2ban: apt-get install fail2ban -y cp /etc/fail2ban/jail.conf /etc/fail2ban/...
0
votes
1answer
39 views

CentOS server blocking own outgoing traffic

I've got a server (CentOS 6.7) running, which causes me some headaches. A few months ago, the website running on the server was unavailable. After some digging, it appeared that Iptables was blocking ...
1
vote
0answers
37 views

How do I specify multiple logfiles for a jail in fail2ban?

Heyo, I'm using Ubuntu 15.10 and fail2ban 0.9.3. Apache is set up with a bunch of Apache virtualhosts. I have my Apache2 logfiles located in subdirectories, one per localhost, e.g. '/var/log/apache2/...
-1
votes
2answers
304 views

How can I reject spam before reaching SMTP on Postfix

My server has started receiving thousands of attempts to use my mail server to send spam from dynamic.hinet.net. The attempts are always rejected, but it's non-stop. I'd like to block these attempts ...