0
votes
1answer
40 views

Brute force attacks with server's IP

I am running a Debian wheezy server with fail2ban installed, everything works as expected but recently my own server got banned. I added the server's IP in the exception row and it seems to work, but ...
1
vote
4answers
71 views

Securing debain with fail2ban or iptables

I'm looking to secure my server. Initially my first thought was to use iptables but then I also learnt about Fail2ban. I understand that Fail2ban is based on iptables, but it has the advantages of ...
5
votes
1answer
133 views

How to *add* rules in local fail2ban filter definition?

I have installed fail2ban as packaged by Debian on a server under my control. Since I have some failregexes from before, I'm putting those into the local filter definition file so they will be ...
0
votes
1answer
127 views

fail2ban iptable rule wont block

So I set up fail2ban on my Debian 7 server, still I've been getting hit a lot and I dont know why is not blocking properly. The regex works, it recognizes the attempts but it seems the iptables rules ...
3
votes
1answer
404 views

fail2ban on server with LXC Containers

The issue is modprobe and iptables don't work inside an LXC Container. LXC is the userspace control package for Linux Containers, a lightweight virtual system mechanism sometimes described as ...
0
votes
1answer
519 views

fail2ban statistics?

Is there a program that parses fail2ban.log and produces some statistics? Or should I set out and write something custom for our hosts? We run mostly Debian and fail2ban with iptables.
0
votes
1answer
145 views

Fail2ban Custom Port

I have a rule like this in my jail.local file: [ssh-ddos] enabled = true port = ssh,sftp filter = sshd-ddos logpath = /var/log/messages maxretry = 4 If I want to use a custom port for SSH, ...
1
vote
2answers
293 views

Fail2Ban direct to website

Is it possible to set fail2ban to direct banned ips to a webpage instead of breaking connection and getting the timed out errors?
2
votes
3answers
2k views

Why isn't fail2ban blocking failures?

This below is the output of fail2ban log. Nothing more shows up, but in auth.log I see like hundreds of failures for root user login (someone is bad ass brute forcing). 2011-07-06 01:48:16,249 ...
1
vote
1answer
145 views

fail2ban on Ubuntu (defaults okay?)

I run an Ubuntu-based web-server (LAMP) and have installed fail2ban. Does it have sensible defaults to restrict malicious activity via SSH and any LAMP ports out-of-the-box? Or, does it need to be ...