2
votes
1answer
882 views

fail2ban for windows 2008 RDP [duplicate]

I'm looking for a solution to make remote desktop more secure. I'm looking for a fail2ban like for windows and specially for RDP which will block IP in firewall after N failed retries Any help?
0
votes
1answer
183 views

Point fail2ban to new log, without losing current bans?

I have logs in /var/log/syslog/YYYY-MM-DD/file.log files. New directories are created automatically by rsyslog, and logs are automatically put to new locations. Every day, I archive previous day of ...
0
votes
0answers
125 views

Blocking X-forwarded-For IP in fail2ban?

I am using a reverse proxy in front of my web-server. In the web server I installed fail2ban and want to use it to monitor logs and block bad ip. I am using nginx with the http realip module. But ...
1
vote
3answers
510 views

Firewalls (ufw vs apf) on Ubuntu

On my LAMP servers, do either of the firewall interfaces (ufw or apt) allow you to setup rate limiting to automatically ban brute force attempts (e.g. via SSH)? Or, is it best to install fail2ban in ...
1
vote
2answers
501 views

Software vs. Hardware Appliance DDOS & Firewalls [duplicate]

I run several Ubuntu Servers (virtualized) and have fail2ban installed for DDOS mitigation. For a firewall, each server has iptables. I'm evaluating my security options and was wondering how well ...
0
votes
2answers
195 views

Updating Hardware Firewall Rules From Fail2Ban?

I am a sysadmin and I was wondering if its possible to script or ideally use a built in feature to update a hardware firewall banned IP list from rules generated by fail2ban. I have done a bit of ...
9
votes
5answers
14k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
1
vote
1answer
143 views

fail2ban on Ubuntu (defaults okay?)

I run an Ubuntu-based web-server (LAMP) and have installed fail2ban. Does it have sensible defaults to restrict malicious activity via SSH and any LAMP ports out-of-the-box? Or, does it need to be ...