Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

0
votes
0answers
21 views

Fail2ban 0.9.3 not working on centos7.2

I'm really struggling with this. The default [sshd] jail works fine. Status for the jail: sshd |- Filter | |- Currently failed: 0 | |- Total failed: 0 | `- File list: /var/log/secure `- Actions ...
0
votes
0answers
15 views

Fail2ban error 'database is locked' when trying to start / restart it

I am currently reinstalling fail2ban to have a fresh version, because i've modified it quite a lot of time since I installed it for the first time, and I wanted to default settings for it. Once ...
0
votes
1answer
16 views

fail2ban - virtual host specific

Is it possible to set up fail2ban to ban ip addresses only for certain virtualhost? For example I have a filter that detects various attempts to run *.php file inside website structure. Which I would ...
0
votes
0answers
9 views

activate geoip settings when certain locations detected

I have a website that is attacked from time to time by ddos attackers. Such attack can disable the webpage for days. The webpage serves for few countries so if I know about the attack, the solution is ...
0
votes
0answers
8 views

fail2ban is interpolating invalid brackets for jail name

I have a fail2ban action with an actioncheck definition like so: actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name> This is part of a repeat offenders script I found, and ...
0
votes
1answer
20 views

Fail2ban not respecting email settings

In Fail2ban I have set up my email settings as: # Destination email address used solely for the interpolations in # jail.{conf,local} configuration files. destemail = me@hotmail.com # # Name of the ...
-1
votes
0answers
20 views

fail2ban - ban ips accessing non-existing urls too often

would it be possible and good idea to ban for certain amount of time, ips that try to call non-existing urls fequently? This is a performance problem for my system - drupal, as it avoids caching. ...
0
votes
0answers
21 views

fail2ban jail not working

I am struggling to get a single jail working in fail2ban. Fail2ban seems functional, and other jails are working. I have tried using fail2ban-regexp and it seems to be matching multiple times, but ...
0
votes
1answer
24 views

fail2ban apache-badbots not blocking IP

I'm trying to get fail2ban to block certain bad bots from hammering my website. I started off with just enabling the default "apache-badbots" in jail.local (I did change the logpath to match my own ...
1
vote
1answer
24 views

how to configure `sshd_config` so fail2ban can see bots

I've updated my sshd_config to be more strict against bots. namely: only keys are allowed, except for a few specified users on specific ips MaxAuthTries = 1 no root login This has been both good ...
0
votes
1answer
114 views

I'm trying to catch brute force against /xmlrpc.php with fail2ban

I'm getting a ton of failed a ton of failed access: 185.103.252.174 - - [28/Apr/2016:15:09:16 -0400] "POST /xmlrpc.php HTTP/1.1" 499 0 "-" "Googlebot/2.1 (+http://www.google.com/bot.html)" ...
0
votes
0answers
20 views

Can fail2ban detect and block IP-ranges?

Every day I get hundreds of this lines in my mail.log: Apr 28 11:10:28 servername amavis[30077]: (30077-08) Blocked SPAM {DiscardedInbound,Quarantined}, [185.140.110.16] <xxx@yyy.com> -> ...
0
votes
0answers
26 views

Having trouble getting correct information from Motion camera streaming server for fail2ban

I have a camera running a Motion streaming server, which uses simple HTTP md5 authentication, tunneled through stunnel on the server side. I'm using like to have fail2ban limit requests just for ...
0
votes
0answers
21 views

fail2ban: regex to block \x00 requests?

Every once in a while my server goes down, and when I check my nginx logs, I usually see something like this: 78.37.54.31 - - [20/Apr/2016:20:58:51 +0300] ...
2
votes
3answers
79 views

Do AWS Servers need fail2ban?

I saw that while I was creating my AWS instance I opted for only my IP address being able to access my server. Also There is a RSA key that is configured for you. In this case do I really need ...
1
vote
1answer
17 views

Fail2ban logging correct ip on Varnish but still not locked out

I am trying to configurefail2ban to ban bad WordPress login attempts, but I'm not having much success. I am using WP fail2ban 3.0.0, which correctly logs bad login attempts on /var/log/secure, as far ...
-1
votes
1answer
35 views

Which Nginx log file is for fail2ban?

I have files in /var/log/nginx/ the log file /var/log/nginx/access.log is empty. But the /var/log/nginx/access.log.1 is being appended as always. In file /etc/fail2ban/fail2ban.conf, logtarget = ...
0
votes
0answers
25 views

Fail2Ban WordPress filter not working on Debian VPS

I am having trouble getting WordPress Fail2Ban filter to work. I have installed the WP Fail2Ban plugin using the latest update which had a few changes, however, nothing is getting blocked. Here is a ...
0
votes
1answer
27 views

Fail2Ban login filter not working on Debian Web Server

So I am having issues getting Fail2Ban to work with as a custom filter for a web app login. First of all, other filter do work such as NGINX Auth. However, my emails have stopped working, not sure why ...
1
vote
1answer
30 views

Allow winscp/filezilla through iptables and fail2ban

I just launched a website within my school community and woke up this morning to logs of someone trying to bruteforce into my server. I followed some guides on digitalocean to set up fail2ban and ...
0
votes
1answer
22 views

sending command to salt from fail2ban

what I'm trying to do is modify my action.d/iptables-allports.conf: actionban = ssh fail2ban@saltmaster.net 'salt '*' iptables.insert position=1 rule='-s <ip> -j DROP -m comment --comment ...
0
votes
1answer
68 views

Fail2ban compatibility debian debian jessie systemd

Fail2ban debian jessie package not working: On fresh debian jessie with openssh-server (tested in docker container): root@2b29327677c8:/# cat /etc/debian_version 8.3 root@2b29327677c8:/# apt-get ...
0
votes
0answers
35 views

fail2ban regex correctly write

Sorry for my bad english. Server nginx. Block /administrator/ http_access_module nginx-error.log [error] 10934#0: *11435 access forbidden by rule, client: 213.87.x.x, server: localhost, request: ...
0
votes
0answers
20 views

fail2ban error: “WARNING Too much read error. Set the jail idle”

I get this error after a few days and it renders the fail2ban to ignore attacks on the specific filter: 2016-03-11 17:06:35,686 fail2ban.filter : ERROR Unable to get stat on ...
0
votes
0answers
27 views

Fail2ban fails to start when setting an action

After installing fail2ban and modifying its configuration it fails to start whenever i set the action to anything... here is the error, but note that $(action_mwl)s can will be diferent for any ...
0
votes
0answers
14 views

Fail2Ban bans all ports/protocols instead of specific port(s)

My jail.local: [siplimit-ban] findtime = 300 enabled = true filter = siplimit protocol = udp logpath = /var/log/syslog maxretry = 15 bantime = 3600 port = 5060,5061 And my iptables after ...
0
votes
1answer
58 views

Does fail2ban start automatically each time system starts?

I've just installed Fail2ban on Ubuntu 14.04 and there's something I want to ask: Does fail2ban start automatically each time system starts? I think so, but just want to make sure, since I've read ...
1
vote
1answer
52 views

Fail2ban bans me after sending successful 5 mails

Dear all I am using Fail2Ban v0.8.13 on CentOS 6 system in order to protect my Postfix servers. Basically it works so after 5 wrong login attempts on SMTP I get banned. Fail2Ban Jail conf ...
0
votes
0answers
19 views

Optimizing log file size on Ubuntu VM

This is a fact-finding question. I'm implementing fail2ban to keep some unscrupulous elements out of my Django website's experience. Note that my webserver is nginx (reverse proxy) with gunicorn as ...
-4
votes
2answers
98 views

Fail2Ban to block IPs that request the same URL repeatedly [duplicate]

Is it possible to use Fail2Ban to block IPs that request the same URL more than 5 times in 10 seconds? I'm not talking about a specific URL, but any random URL of the site that is being requested ...
0
votes
1answer
35 views

phpmyadmin fail2ban failed login log

I have a Debian server with phpmyadmin. I want to use fail2ban to block brute force attack. I have questions: How can I log the failed login attempts to log? Where to set that? I can only find ...
3
votes
1answer
113 views

Should i use Firewalld or Iptables for Fail2ban in Centos 7?

I'm setting up Fail2ban to protect ssh, and I use firewalld, I saw a lot of people recommending to use anaction = iptables-multiport and other solutions using iptables instead of firewalld claiming ...
0
votes
1answer
50 views

Unable to reinstall fail2ban after completly removing it from Centos 7

After completely removing Fail2ban from Centos 7, I decided to reinstall it. So I run the installation(yum), and everything seems ok, no errors, But the it seems like the installation does not create ...
0
votes
0answers
37 views

fail2ban doesnt read log if file being used

My environment is Ubuntu 14.04, LAMP stack all from apt. implemented fail2ban and configured jail.local with backend = auto [ssh] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log ...
1
vote
0answers
52 views

Fail2ban floods and slow response time

I tried searching for this; I found many people asking but I wasn't successfully to find a working (for me) solution. I have an application that logs each connection on a custom log file. When ...
0
votes
0answers
83 views

Issue with Fail2ban and Mikrotik Firewall

OS: CentOS 7.1 At my organization we are currently assessing using Fail2ban with the firewall on our Mikrotik router. I want Fail2ban to communicate any IP flagged as banned to the Mikrotik ...
1
vote
1answer
49 views

Fail2Ban regex is wrong?

I'm currently setting up a filter to filter POST attacks on a file named xmlrpc.php. Requests that should be monitored in the log access look like: 1.99.437.201 - - [01/Feb/2016:01:57:14 +0000] "POST ...
0
votes
0answers
38 views

Nagios check_log reset to OK after notification

Fail2ban is installed on one of the servers, I'm able to ban every IP that try to log in. I'm using the check_log plugin of Nagios to capture the last line of the fail2ban.log, it compares to the ...
0
votes
2answers
362 views

How to check if firewalld is blocking an incoming ip address?

I have CentOS 7 with firewalld. I installed fail2ban and using the firewallcmd-new action. I am seeing bans in the fail2ban logs, and I want to check in firewallcmd if they are blocked. How can I do ...
0
votes
1answer
99 views

why fail2ban does not ban? (ubuntu, ssh)

I installed a fresh Ubuntu machine. Then I changed the ssh port which is no more 22 but 22111: Then I have installed fail2ban: apt-get install fail2ban -y cp /etc/fail2ban/jail.conf ...
0
votes
1answer
36 views

CentOS server blocking own outgoing traffic

I've got a server (CentOS 6.7) running, which causes me some headaches. A few months ago, the website running on the server was unavailable. After some digging, it appeared that Iptables was blocking ...
1
vote
0answers
33 views

How do I specify multiple logfiles for a jail in fail2ban?

Heyo, I'm using Ubuntu 15.10 and fail2ban 0.9.3. Apache is set up with a bunch of Apache virtualhosts. I have my Apache2 logfiles located in subdirectories, one per localhost, e.g. ...
-1
votes
2answers
183 views

How can I reject spam before reaching SMTP on Postfix

My server has started receiving thousands of attempts to use my mail server to send spam from dynamic.hinet.net. The attempts are always rejected, but it's non-stop. I'd like to block these attempts ...
0
votes
0answers
18 views

Linking fail2ban with a RDBMS

I would like to maintain a highly dynamic RDBMS table that will be insert/update/deleted from from multiple hosts (a kind of global blacklist for all my servers). The table would have a couple basic ...
1
vote
2answers
189 views

Configure Fail2ban for SSH and ldap

I have a fail2ban Installation on two Centos7 machine. And I want to secure SSH with it so I installed (The SSH protecting seems active) and set the allowed pw-fails to 5 and I left the banntime at ...
0
votes
1answer
51 views

Fail2ban with Hipchat server

Has anyone managed to get fail2ban working with hipchat server? I've found the log file and here's an example of a failure; Authentication for 'user@domain.com' failed. HTTP code: 403, XMPP error: ...
0
votes
1answer
41 views

Fail2Ban blocks ip in ignoreip list

Fail2ban continues to block an ip even after I have whitelisted that ip. I have in /etc/fail2ban/jail.conf a line like the following. ignoreip = 53.45.114.103 However fail2ban continues to block ...
1
vote
0answers
98 views

How to detect SMTP AUTH attempts in Fail2Ban?

I have a Fail2Ban jail that monitors failed SASL authentications to my Postfix SMTP server. When this occurs, /var/log/mail.log contains these three lines: postfix/smtpd[32591]: connect from ...
1
vote
1answer
99 views

Fail2Ban regex to match these lines?

I've been trying to get fail2ban to work with the Xeams email spam filter. But, I can't figure out what possible regex I should use to match the logs. The logs are in this format. 61.240.144.65 ...
2
votes
1answer
200 views

Fail2Ban not banning IPs with different ports

I am getting different SSH attacks from the same IPs and they are getting banned. But they are using a different port and all they have to do is change the port to bypass the ban. Dec 28 23:16:57 ...