Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

0
votes
2answers
42 views

High inbound and outbound network traffic

Over the last day or so, one of instances has had a large amount of bandwidth consumed. This means that we have nearly exceeded our allowance (roughly the same amount inbound and outbound). Looking ...
0
votes
1answer
13 views

How to ban a ip with fail2ban using fail2ban-client and actionban

I am on fail2ban 0.8.3 and I would like to ban an ip address after reloading fail2ban. I tried: fail2ban-client get myjail actionban ip after that I get an empty line in bash and fail2ban status ...
1
vote
1answer
40 views

Fail2Ban Not Banning on CentOS 7 with SELinux

On a LEMP stack with WordPress and the WP fail2ban plugin, WordPress authentication issues get logged to /var/log/messages perfectly fine. $ sudo fail2ban-client version 0.9.2 In the last couple ...
2
votes
1answer
43 views

How to change mail “from” name for Fail2Ban email notifications?

I have Fail2Ban sending me emails from various servers but I can't tell at a glance which server because the email "from" name is always just "Fail2Ban". I've managed to set the "from" address ...
0
votes
1answer
32 views

fail2ban not mailing on Arch

I have 3 servers, 2 Debian and 1 Arch. As usual the Arch makes me work hard for the simple things. This time it's fail2ban. My installation of fail2ban is default, its version 0.9.3-3. To test if my ...
0
votes
1answer
25 views

why is are there dns host names in my iptables entries? (fail2ban)

I recently installed fail2ban which has begun blocking bad ssh attempts. I also set up an additional filter to permanently ban repeat offenders. I notice now that there are some entries in my ...
0
votes
0answers
39 views

ERROR Found no accessible config files for 'fail2ban' under /etc/fail2ban

So my fail2ban wasn't working and in attempts to make it work the config files got messy. Decided to start from scratch. I ran these as sudo apt-get remove fail2ban apt-get purge fail2ban rm -r ...
0
votes
1answer
13 views

fail2ban couriertcpd: LOGIN FAILED not banning

My fail2ban is not banning as I expect. An example of my log entries are :- Jul 26 07:11:29 mail couriertcpd: LOGIN FAILED, user=sally, ip=[::ffff:54.191.110.169] Jul 26 07:13:22 mail couriertcpd: ...
-1
votes
1answer
24 views

IPTABLES not working, fail2ban still notifying me of instrusions from those ips

I added 200 hundred iptable rules like these: iptables -A INPUT -s 108.62.150.0/24 -j DROP iptables -A INPUT -s 109.108.64.0/19 -j DROP iptables -A INPUT -s 109.110.32.0/19 -j DROP to block russian ...
0
votes
1answer
37 views

fail2ban config failregex for Tomcat 8 [closed]

The current fail2ban version 0.9.1 does not have a pre-configured filter for Tomcat. In case anyone needs it, here is a regex that works for me. Note that my application is not expected to have any ...
1
vote
0answers
15 views

Nginx: Logging 403's from proxies

So our server setup goes like this: www <-> nginx <-> backend services The internal services require authorisation, which often fails with a 403 if a user's token is incorrect and so ...
0
votes
0answers
85 views

Trouble figuring out a fail2ban log error message: “iptables -n -L INPUT | grep -q 'fail2ban-SSH[ \t]' returned 100”

Here is my jail.local rule for ssh: [ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] logpath = /var/log/messages maxretry = 5 Here is what my ...
0
votes
0answers
58 views

fail2ban wont ban ssh from local hosts

I'm trying to configure fail2ban to block ssh from a local hosts. Fail2ban is install on CentOS 7 with firewall (Linux 3.10.0-229.4.2.el7.x86_64 x86_64 ). I have copied the jail.conf to jail.local i ...
0
votes
0answers
25 views

Fail2ban not unbanning ip from jail

I've tried finding a way to unban an IP from fail2ban, but no matter what I do it seems to stay banned. I recently ran fail2ban-client get ssh actionunban myip and I do not get an error message, but ...
0
votes
0answers
23 views

fail2ban stops logging after some time (3-4 days)

I've noticed that whenever I want to see fail2ban logs after 3 or 4 days of being working, it compresses the logs to .gz which Im fine with that: -rw-r--r--. 1 root root 90034 May 1 12:49 ...
-2
votes
1answer
29 views

Default rules in fail2ban for apache

What does default apache (apache-auth, apache-overflows, apache-noscript) fail2ban jails do? I looked into docs, but there is nothing about it. Thanks for your help!
1
vote
0answers
47 views

Selinux: Shorewall will not respond to fail2ban

I am using fail2ban with shorewall and my Fedora 21 server & cloud. All flooded with the following error message: SELinux is preventing shorewall from write access on the file ...
0
votes
1answer
56 views

journalctl: Cannot filter ownCloud log lines, fail2ban will not ban

Using a general journalctl command, the log line of interest appears: [root@bee server]# journalctl -n -- Logs begin at Mon 2015-01-26 19:44:33 EET, end at Wed 2015-06-10 21:41:12 EEST. -- ... Jun 10 ...
-2
votes
1answer
56 views

Apache server crashes due to bandwidth spike issue [closed]

The problem I am facing is that my Website (hosted on a dedicated VPS) was working fine for last 6 months. However from last two days, it gets huge spikes of DATA coming in and this causes server to ...
3
votes
1answer
95 views

Fail2ban redirect

I've just finished setting up fail2ban on my Centos reverse proxy server. I was able to get it to block all requests if a certain criteria was met (pretty straight forward). However, I'd now like ...
-1
votes
1answer
43 views

How to prevent password bruteforce in web application? [closed]

I have php web application (nginx+php-fpm). And someone try to bruteforce password. He have a lot of IPs. Also these bruteforce works like DDOS because each time web application starts and try to ...
0
votes
0answers
32 views

Make Fail2ban parse latest logs generated monthly.

I have a log file generated monthly (e.g messageApril2015.log,messageMay2015.log). Can anyone tell me how to make fail2ban parse the latest log? I have read somewhere about adding %F%Y but it didn't ...
0
votes
0answers
17 views

Bad Referer AND DNS Cache Poisoning [duplicate]

I am annoyed by a lot of bad referer spammers I am seeing in apache's logs. 208.118.126.250 - - [12/May/2015:17:45:06 +0200] "GET /js/parsley.js HTTP/1.1" 200 91434 "http://voiceit.be/logins/login" ...
0
votes
1answer
56 views

Fail2Ban Filter Errors

I'm trying to add two fail2ban filters, one for post flood and phpmyadmin brute force but i get the following errors. logs: fail2ban.filter : ERROR No 'host' group in '[[]client []] File does not ...
0
votes
0answers
104 views

Can't pass Fail2ban banned IP's to CloudFlare in Nginx?

I have Ubuntu 14.04, Nginx 1.6.2, MySQL 10.0.17-MariaDB, PHP 5.5.24 VPS. It running two WordPress sites. I use fail2ban with CSF. Fail2ban I use ban action as route, because iptables-multiport and ...
4
votes
1answer
190 views

How to blacklist or whitelist lots or few ip ranges with ipset and iptables + fail2ban

EDIT: It's astonishing how the urge to find a solution sometimes is sufficient to slowly but steadily lead one towards a solution. Also, the more often I reread my question in order to clarify it, I ...
0
votes
1answer
90 views

fail2ban keeps trying to ban again

I have an issue getting fail2ban to do what I want. I use a action which bans the IP on CLoudFlare, that means that still a lot of requests get through until everything has been updated on ...
0
votes
1answer
138 views

Modify fail2ban failregex to match failed public key authentications via ssh

fail2ban doesn't recognize failed public key ssh logins and I assume that this can be solved by modifying the failregex of /etc/fail2ban/filter.d/sshd.config to match the following line: <date> ...
2
votes
2answers
224 views

Fail2ban critical exception - does not block ips

I'm trying to get fail2ban running on CentOS7 (no SELinux) and it uses firewalld. My goal is to set it to ban Asterisk password fails. Setup was default yum install fail2ban Config-wise I ONLY added ...
1
vote
1answer
149 views

fail2ban says banned, but can still log in

Running fail2ban 0.8.14 on CentOS 6.5 with Python 2.6.6, fail2ban puts my IP in the banned list, but doesn't actually prevent me from logging in. Here's an example of a failed ban in ...
0
votes
1answer
165 views

ipTables IP Range will not be blocked

I have setup fail2ban with this Tutorial http://wireflare.com/permanently-ban-repeat-offenders-with-fail2ban/ and it seems working. But the attackers are changing their IPs and thats why I decided to ...
0
votes
1answer
129 views

Can't connect to Ubuntu VPS via SSH,SFTP

When I try to login to my VPS using SSH and SFTP it's not connect to the server. Then I power off and power on the VPS by the VPS provider control panel (digital ocean). Once it boot up, first few ...
1
vote
1answer
457 views

Regex for multiple sshd Received disconnect from … [preauth]

What fail2ban regex would catch logs like these? Apr 9 08:48:28 server sshd[1856]: Received disconnect from 43.255.190.117: 11: [preauth] Apr 9 09:06:05 server sshd[1936]: Received disconnect ...
0
votes
0answers
20 views

How do I ban IP's that request files that do not exist using fail2ban? [duplicate]

I have recently started using Fail2Ban and need to configure a specific 'Jail'. My apache error logs are filled with requests for files within my /var/www folder. The folder doesn't contain any ...
-3
votes
1answer
28 views

What configuration is necessary for fail2ban to be useful? [closed]

If I simply install fail2ban on my server with sudo apt-get install fail2ban without configuring anything, does this provide adequate protection? It seems that fail2ban comes with 1-2 pages of jails ...
2
votes
0answers
83 views

“Centralized” fail2ban only banning attacks to local host

I'm trying to run fail2ban on the rsyslog server that gathers auth logs from the rest of our servers. I'm interested on getting notifications working as a first step. My problem is that fail2ban only ...
0
votes
1answer
299 views

Loading fail2ban rules to iptables using iptables-persistent

I am using iptables-persistent package to reload my iptables on boot. And I have been thinking should I add the fail2ban rules to the loaded config file? Now I am seeing they are duplicated. This is ...
0
votes
1answer
37 views

Cannot understand this example fail2ban rule

I'm trying to secure my admin and user login page from brute force attacks. I have setup iptables and the closest thing I can find which looks useful is this: jail file: [nginx-login] enabled = true ...
-1
votes
1answer
39 views

fail2ban identify the subscription specific error log which resulted in an IP ban [closed]

I am running Fail2Ban via Parallels Plesk 12.x on several CentOS 6 containers with several active jails (apache-noscripts, plesk-apache etc.). The Fail2Ban.log provides the IP address which was ...
0
votes
0answers
115 views

prevent phpbb bruteforcing with mod_security

Update: I edited this and added a fail2ban tag. Perhaps that might be another way to handle this issue. I'm running phpbb 3.0.13-PL1 and I would like to protect the login page from bruteforcing. I'm ...
0
votes
0answers
62 views

fail2ban WARNING invalid command on apache2 disabled websites

I have a problem on a Debian Squeezy webserver running fail2ban. Now and then, fail2ban stops working complaining of missing access.log: fail2ban.comm : WARNING Invalid command: ['set', ...
0
votes
1answer
119 views

Setup fail2ban with apf

Along with BFD we have recently installed fail2ban on our server, it is CentOS and it uses APF to block IPs. I have hunted online on how to get the two to work however when an IP is blocked by ...
1
vote
1answer
332 views

Fail2ban configuration for nginx using firewallcmd in CentOS 7

Previously I have a CentOS 6.5 with Iptables and I configure some jails for nginx as suggested here: How To use fail2ban for Nginx?. But now I am in CentOS 7, trying to use the new firewall and ...
1
vote
0answers
116 views

What this error means on Fail2ban?

I've installed fail2ban on my server. Anyway, I've seen this error on Fail2ban Log... What does it means? Here's the error 2015-02-09 06:11:21,076 fail2ban.filter [23563]: INFO ...
1
vote
1answer
251 views

How to interpret postfix logs on Ubuntu

I just installed postfix on my server which runs Ubuntu 14.04.1 LTS. I am a little confused as to how I should interpret the postfix logs located at /var/log/mail.log. Firstly, one of the reasons I ...
0
votes
1answer
1k views

Fail2ban doesn't start [closed]

I've done some changes to the file /etc/fail2ban/jail.local (a copy of /etc/fail2ban/jail.conf) and saved, but now fail2ban doesn't start. If I erase jail.local, then it start again. So the problem is ...
1
vote
2answers
452 views

fail2ban error on setting iptables on Synology NAS

I setup fail2ban 0.9.1 on my Synology NAS to handle failed SSH attempts. When I startup the jail I get the following errors in fail2ban.log: 2015-02-01 17:22:52,394 fail2ban.jail [30576]: ...
2
votes
1answer
87 views

fail2ban did not ban anything, regardless of the settings

this is the first time that i did not find a solution here. so, hopefully it can be solved. i've installed a fresh, new ubuntu minimal system (14.04) with ssh on it. Right after that i installed ...
1
vote
2answers
154 views

Fail2ban maxretry meaning

I'm reading the following page to set up fail2ban on my Ubuntu server: https://help.ubuntu.com/community/Fail2ban In the "Configuration" section, it shows the following settings: [DEFAULT] # ...
1
vote
0answers
164 views

Apache blocking based on combination of ip, request and useragent - Can fail2ban do that?

3 times over the past 48 hours, we had about a 6X spike in traffic lasting a few hours. The server handled it each time, but just barely. This was almost all bad-bot traffic (or maybe failed DOS ...