Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.
0
votes
0answers
37 views
How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?
Fail2Ban on Ubuntu 10.04
Configuration files
/etc/fail2ban/jail.local
[DEFAULT]
ignoreip = 127.0.0.1
bantime = 10 # made for test purposes
maxretry = 3
backend = polling
destemail = ...
-3
votes
1answer
30 views
Logrotate error for fail2ban
I get the following error when running a cron job, and I'm not too sure how to go about fixing. This is on Ubuntu 12.04 LTS.
test -x /usr/sbin/anacron || ( cd / && run-parts --report ...
0
votes
0answers
41 views
How to protect Nginx from HULK DoS tool
There is a tool called HULK (Http Unbearable Load King). It's a web server denial of service tool. It is designed to generate volumes of unique and obfuscated traffic at a webserver, bypassing caching ...
1
vote
2answers
45 views
Strange java user agent in access.log
I recently noticed a huge load on my main production server, after some log parsing i stumbled upon a large number of those user agents originate from about 20 different IPs:
173.244.182.194 - - ...
0
votes
2answers
39 views
Is there any reason to use fail2ban with SSH password logins disabled?
I am setting up an Ubuntu server hosted by Linode.
I am stepping through their security guide and they recommend installing fail2ban after disabling password based SSH logins.
I don't see the point ...
0
votes
1answer
44 views
Anti-DDos Apache2 Fail2ban regex rule
I have fail2ban up and running, but my Failregex doesnt match anything, something is wrong.
Request which i like to ban look like this:
186.6.65.199 - - [06/May/2013:18:46:21 +0400] "GET / HTTP/1.1" ...
0
votes
1answer
31 views
Run fail2ban without banning
It is possible to run fail2ban in some kind of "simulation mode" so it does not ban but log somewhere who it would have ban?
Running fail2ban on Ubuntu 12.04.
Thanks
-1
votes
0answers
13 views
fail2ban being attached with false IP address [closed]
I am wondering if this could be possible:
The hacker send TCP/IP packets with "false IP address" to the server with fail2ban installed. Those false IPs will be banned by fail2ban program so those ...
0
votes
0answers
28 views
Fail2ban fails to parse logs, no error, no warning, no banning on CentOS
Using latest build (0.8.8) on CentOS i've setup fail2ban to filter Kerio spam/harvest attacks.
Here's my kerio.conf
[INCLUDES]
before = common.conf
[Definition]
failregex = .*SMTP connection from ...
1
vote
2answers
59 views
Can Fail2Ban recognise failed logins to locked accounts?
I have locked the root account on my server with passwd -l root and so an attempted login results in the following in /var/log/auth.log:
User root not allowed because account is locked
Fail2Ban ...
2
votes
1answer
79 views
Installing from EPEL on Amazon EC2
I am trying to install fail2ban on our Amazon EC2 Linux AMI (CentOS). I know that fail2ban is in the EPEL so I have done the following:
wget ...
0
votes
1answer
47 views
Does fail2ban monitor rotated log files?
Does fail2ban continue to monitor rotated log files?
For example, I have a rule monitoring /var/log/fail2ban.log which is automatically rotated by the system every week (7 days). I want to have a ...
3
votes
1answer
101 views
fail2ban cannot ban ip on all ports if it's already banned for specific port
I'm using a custom filter in fail2ban to search through it's own log and ban an ip after 5 bans from any of the regular filters. I'm using iptables-allports as action for this. All other filters are ...
1
vote
0answers
59 views
Fail2ban on Ubuntu 11.10 does not ban custom filter/jail
An application I'm running logs incorrect logins such as this:
Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere !
Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere !
Tue, 19 Mar 13 ...
1
vote
1answer
238 views
How to set up fail2ban to read multi log in a jail?
How can I configure multiple logpaths for the same rule?
I'm trying to write a syntax like this:
[apache-w00tw00t]
enabled = true
filter = apache-w00tw00t
action = iptables-allports
logpath = ...
0
votes
2answers
98 views
Setting up fail2ban to ignore connections behind a dynamic IP
Using fail2ban to secure an Ubuntu 12.04 x64 Server on DigitalOcean, while editing /etc/fail2ban/jail.local there's this part:
[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host
...
-1
votes
1answer
127 views
Fail2ban memory usage
Since my server is under a sustain DNS amplification attack (DDOS),
I configured fail2ban and initially my outgoing traffic dropped markedly.
Anyway, after a few hours (mostly +10), fail2ban uses ...
2
votes
1answer
258 views
fail2ban custom action to permanent ban IPs from China
When a IP address gets banned how can I check if the banned IP address is from China. If yes, then add it to the permanent ban list.
I have found this nice guide which write the banned IP to file.
...
4
votes
1answer
601 views
measures to take against a dns amplification attack
I recently discovered that my server was being used as part of a DNS DDOS. Basically, my BIND setup allowed recursion, and it was used to attack a certain IP address using IP spoofing.
I took the ...
1
vote
2answers
380 views
Have fail2ban send notification to banned party
I have fail2ban configured on some CentOS 5 and 6 servers, and it sends me an email with a whois of the IP whenever an IP is banned. Is it possible to configure fail2ban to also send a notification ...
0
votes
1answer
116 views
Do we need PSAD if we already have Fail2Ban?
I already have installed Fail2Ban on my server. I planned to install PSAD on it. Are they equal? Isn't it a good idea to keep them both?
2
votes
2answers
156 views
fail2ban-apache not blocking IP
I'm trying to configure fail2ban, I attempted to log into my web server numerous times to trigger the rule and looking at my iptables it seems to have worked:
Chain fail2ban-apache (1 references)
...
5
votes
1answer
978 views
Custom fail2ban Filter for phpMyadmin bruteforce attempts
In my quest to block excessive failed phpMyAdmin login attempts with fail2ban, I've created a script that logs said failed attempts to a file: /var/log/phpmyadmin_auth.log
Custom log
The format of ...
1
vote
3answers
752 views
Setting up fail2ban to ban failed phpMyAdmin login attempts
We've been using fail2ban to block failed ssh attempts. I would like to setup the same thing for phpMyAdmin as well.
As phpMyAdmin doesn't log authentication attempts to a file (that I know of), I'm ...
2
votes
2answers
288 views
iptables with Cloudflare
I'm using fail2ban to block web vulnerability scanners. It is working correctly when visiting the site if CloudFlare is bypassed, but a user can still access it if going through it. I have ...
0
votes
1answer
251 views
Fail2Ban adds iptable rules but they are not working?
Fail2Ban just blocked my IP for 3 SSH attempts. It added the iptables rule and I can see it using the "sudo iptables -L -n" command. But I can still access the site and login through SSH! What might ...
-2
votes
2answers
235 views
Is it a good idea to disable Nginx access logs when it comes to security?
According to a blog post I found, disabling Nginx access log can speed things up. Nginx have to write to this file every time some one access the site.
But, when setting up fail2ban, I realized that ...
-4
votes
2answers
2k views
How To use fail2ban for Nginx? [closed]
How can I use fail2ban on an Nginx server? What are the rules to put in the jails.conf?
-1
votes
1answer
70 views
fail2ban Perform a regular expression for failregex [closed]
I needed some help to create a regular expression for failregex to find and ban the source ip (ex. SRC=192.168.0.1 and ban the IP 192.168.0.1) from this log:
[ATT] Suspect: IN=eth0 OUT=
...
0
votes
3answers
570 views
Permanent block of IP after n retries using fail2ban
I have a fail2ban configured like below:
block the ip after 3 failed attempts
release the IP after 300 sec timeout
This works perfectly and I want to keep it this way such that a valid user gets a ...
2
votes
1answer
124 views
fail2ban fails to ban most of the time, why could that be?
It does work, like 5 times out of 3000 or so.
Running on Debian installed with apt-get and added only following jail.local file
cat jail.local
[ssh]
enabled = true
port = ssh
filter = sshd
...
2
votes
1answer
212 views
Multiple IP Addresses in fail2ban
I just got a barrage of pop3-login attacks on one of my servers. I was surprised that fail2ban wasn't stopping them, then I realized that the service is listening on multiple IP addresses, and the ...
2
votes
1answer
221 views
fail2ban on server with LXC Containers
The issue is modprobe and iptables don't work inside an LXC Container.
LXC is the userspace control package for Linux Containers, a
lightweight virtual system mechanism sometimes described as ...
1
vote
1answer
429 views
Fail2ban don't want to start the server
I just installed fail2ban on my Ubuntu 10.04 server.
I modified my jail.conf like this : http://pastebin.com/tEeM2hxe
When i try to start the client it returns :
ERROR Could not start server. ...
2
votes
1answer
440 views
Fail2ban unblock ipaddress
I am trying to unblock a IPaddress without restarting fail2ban each time, what is the best way of doing this? Or can you point me in the direction of a useful guide?
As you can see below the IP ...
3
votes
3answers
3k views
In Fail2Ban, How to Change the SSH port number?
In my server, the ssh port is not the standard 22. I have set a different one. If I setup fail2ban, will it be able to detect that port? How can I tell it to check that port rather than port 22?
The ...
2
votes
1answer
676 views
How do I format this regex so it will work in fail2ban?
I've just installed fail2ban on my CentOS server in response to an SSH brute force attempt. The default regular expressions in fail2ban's sshd.conf file do not match any entries in audit.log, which ...
1
vote
3answers
358 views
Firewalls (ufw vs apf) on Ubuntu
On my LAMP servers, do either of the firewall interfaces (ufw or apt) allow you to setup rate limiting to automatically ban brute force attempts (e.g. via SSH)? Or, is it best to install fail2ban in ...
0
votes
1answer
116 views
Remove wait time of fail2ban after logfile read
We all know that in fail2ban after reading one log file it will wait for 1 second.the problem is that during that waiting time the attacker make lots of attack. so how can we remove this waiting ...
2
votes
2answers
1k views
Fail2Ban - how to prevent my ISP IP dynamic get banned?
I have just installed Fail2Ban.
I want to add my ISP IP to my ignore list but my IP is dynamic.
In the jail.conf file, I have like this:
[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or ...
0
votes
1answer
279 views
fail2ban statistics?
Is there a program that parses fail2ban.log and produces some statistics? Or should I set out and write something custom for our hosts? We run mostly Debian and fail2ban with iptables.
1
vote
2answers
663 views
Fail2Ban on Apache Server to protect against DoS attacks?
I asked a question on the IT security StackExchange about protecting against DoS attacks.
One of the answers was to install Fail2Ban.
I talked to the people that administer the server and they told ...
0
votes
1answer
528 views
Vsftpd: log failed login attempts
I am setting up fail2ban for various services. Ssh went smoothly, but I have had no success with vsftpd so far. The problem is, that I can't find a way to get failed login attempts to appear in the ...
0
votes
2answers
221 views
SSH Authentication - Bruteforce attack prevention
I use certificate/key based ssh authentication with sshd running on non standard port.
Do I still need to install denyhosts/fail2ban or log analysis based detection?. Do I get any advantage?
0
votes
1answer
479 views
fail2ban settings for apache
Basically at the moment our server is set a little too secure and fail2ban is banning users who are just browsing the website even if there is just a missing image for example.
Which of the ...
2
votes
1answer
856 views
Fail2Ban SASL Filter Misses Failed Logins
I am using fail2ban on my mail server. I discovered this morning that there were some 5000 failed login attempts (in the course of 1 hour) via SMTP that didn't get picked up by my sasl filter. Here ...
0
votes
2answers
489 views
fail2ban regex to catch dovecot log entry?
Am trying to write a fail2ban regex that catches anyone who tries the user-id "administrador". For example, this log entry:
Jan 2 09:55:01 mail2 dovecot: pop3-login: Disconnected: ...
1
vote
1answer
84 views
fail2ban with bridge-util
Hello and happy new year,
I am wondering if I can use fail2ban on a virtual host that uses bridge-util.
I am using LXC containers for virtualization and have therefore direct access to all the log ...
2
votes
2answers
486 views
How to block all root login attempts using denyhosts and or fail2ban?
I currently block all ssh logins using root. But I wanted to go the extra mile and block the ip address of the client who tried to login as root. I currently have denyhosts and fail2ban setup and ...
1
vote
2answers
353 views
Software vs. Hardware Appliance DDOS & Firewalls
I run several Ubuntu Servers (virtualized) and have fail2ban installed for DDOS mitigation. For a firewall, each server has iptables.
I'm evaluating my security options and was wondering how well ...
