Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

27
votes
7answers
21k views

Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

I'm setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I've seen many recommendations for both denyhosts and fail2ban, but few comparisons of the ...
15
votes
6answers
25k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
8
votes
5answers
1k views

is fail2ban safe? Better to use ssh keys?

I'm in doubt if I should use key authentication when logging into SSH, or just go for fail2ban + ssh (root login disabled). Is fail2ban safe or is it really better to just go ahead and generate keys ...
8
votes
3answers
5k views

How do I setup monitoring of MySQL with Fail2ban?

Searching the internet with search engines on MySQL and fail2ban yields lots of results on putting your fail2ban logs into MySQL, however I'm wanting to monitor failed MySQL attempts to log in and ban ...
7
votes
4answers
5k views

Permanently and persistently ban an IP with fail2ban

I have set up a custom jail for a spambot that is giving me trouble. Using "bantime -1" I was trying to permanently ban the botnet. I thought it was working, but when the weekly logrotate occured ...
6
votes
5answers
3k views

Is it worth the effort to block failed login attempts

Is it worthwhile running fail2ban, sshdfilter or similar tools, which blacklist IP addresses which attempt and fail to login? I've seen it argued that this is security theatre on a "properly ...
6
votes
4answers
5k views

Permanent block of IP after n retries using fail2ban

I have a fail2ban configured like below: block the ip after 3 failed attempts release the IP after 300 sec timeout This works perfectly and I want to keep it this way such that a valid user gets a ...
6
votes
4answers
9k views

In Fail2Ban, How to Change the SSH port number?

In my server, the ssh port is not the standard 22. I have set a different one. If I setup fail2ban, will it be able to detect that port? How can I tell it to check that port rather than port 22? The ...
6
votes
1answer
2k views

Installing from EPEL on Amazon EC2

I am trying to install fail2ban on our Amazon EC2 Linux AMI (CentOS). I know that fail2ban is in the EPEL so I have done the following: wget ...
6
votes
3answers
326 views

Banning IPv6 addresses

I am currently accustomed to using tools like fail2ban to keep unwanted traffic away from my servers by banning IPv4 addresses: too many bad log entries per IP, ban the IP. However when the world ...
6
votes
2answers
162 views

How to *add* rules in local fail2ban filter definition?

I have installed fail2ban as packaged by Debian on a server under my control. Since I have some failregexes from before, I'm putting those into the local filter definition file so they will be ...
5
votes
3answers
2k views

Why is iptables not blocking an ip address?

I have configured fail2ban to monitor a certain pattern of malicious traffic I'm getting and ban IP addresses associated. Everything seems to be working great -- the regex is matching the pattern ...
5
votes
1answer
1k views

measures to take against a dns amplification attack

I recently discovered that my server was being used as part of a DNS DDOS. Basically, my BIND setup allowed recursion, and it was used to attack a certain IP address using IP spoofing. I took the ...
5
votes
1answer
3k views

Custom fail2ban Filter for phpMyadmin bruteforce attempts

In my quest to block excessive failed phpMyAdmin login attempts with fail2ban, I've created a script that logs said failed attempts to a file: /var/log/phpmyadmin_auth.log Custom log The format of ...
4
votes
5answers
5k views

Stop fail2ban stop/start notifications

If the server is restarted, or even if fail2ban is stopped/start it sends a notification. [asterisk-iptables] enabled = true filter = asterisk action = iptables-allports[name=ASTERISK, ...
4
votes
3answers
2k views

fail2ban not working on fresh install of ubuntu 14.04, why?

After installing and configuring fail2ban, I tried to login to my server through ssh with a wrong password. After a few attempts, I tried with the correct password with success. So, fail2ban didn't ...
4
votes
1answer
4k views

How to set up fail2ban to read multi log in a jail?

How can I configure multiple logpaths for the same rule? I'm trying to write a syntax like this: [apache-w00tw00t] enabled = true filter = apache-w00tw00t action = iptables-allports logpath = ...
4
votes
1answer
3k views

How to test whether fail2ban can really send an email?

I have configured fail2ban but I would like to test sending of email. For example, I would like that I get email when fail2ban is started or stopped.
4
votes
4answers
1k views

How to block all root login attempts using denyhosts and or fail2ban?

I currently block all ssh logins using root. But I wanted to go the extra mile and block the ip address of the client who tried to login as root. I currently have denyhosts and fail2ban setup and ...
4
votes
2answers
138 views

What is the optimum ban duration of a brute force attack?

I use fail2ban to prevent brute force attacks on my production servers. Fail2ban bans an ip after 5 authentication failure and unbans it after 1 hour with my own configuration. I wonder that what is ...
4
votes
6answers
3k views

fail2ban and denyhosts constantly ban me on Ubuntu

I just got an Ubuntu instance on Linode. To secure the SSH on it, I installed fail2ban (using apt-get), but then had a problem: fail2ban kept banning my IP (for limited durations, thankfully) even ...
3
votes
1answer
3k views

Fail2Ban: what is apache-overflows?

I am trying to configure fail2ban for my server and have come across: apache-overflows in the .config What does it do/protect against?
3
votes
2answers
812 views

Fail2Ban: already banned?

I have Fail2Ban running on my Centos Server. (Config below) In my var/log/messages I noticed something really weird: Jun 19 12:09:32 localhost fail2ban.actions: INFO [postfix] 114.43.245.205 ...
3
votes
1answer
2k views

Fail2Ban SASL Filter Misses Failed Logins

I am using fail2ban on my mail server. I discovered this morning that there were some 5000 failed login attempts (in the course of 1 hour) via SMTP that didn't get picked up by my sasl filter. Here ...
3
votes
1answer
117 views

Fail2ban settings after changing ssh port

I switched my ssh port to 22000 and I changed the port settings in /etc/fail2ban/jail.local to specify to ban on both 22 and 22000 but when I tried failing to login 6 times, my connection was cutoff ...
3
votes
2answers
1k views

fail2ban custom action to permanent ban IPs from China

When a IP address gets banned how can I check if the banned IP address is from China. If yes, then add it to the permanent ban list. I have found this nice guide which write the banned IP to file. ...
3
votes
1answer
223 views

fail2ban fails to ban most of the time, why could that be?

It does work, like 5 times out of 3000 or so. Running on Debian installed with apt-get and added only following jail.local file cat jail.local [ssh] enabled = true port = ssh filter = sshd ...
3
votes
2answers
3k views

Fail2Ban - how to prevent my ISP IP dynamic get banned?

I have just installed Fail2Ban. I want to add my ISP IP to my ignore list but my IP is dynamic. In the jail.conf file, I have like this: [DEFAULT] # "ignoreip" can be an IP address, a CIDR mask or ...
3
votes
1answer
433 views

fail2ban on server with LXC Containers

The issue is modprobe and iptables don't work inside an LXC Container. LXC is the userspace control package for Linux Containers, a lightweight virtual system mechanism sometimes described as ...
3
votes
3answers
853 views

The right way to auto block ip's

The problem: I manage a website which has lot's of dynamically generated pages. Every day bots from Google, Yahoo and other search engines download like 100K+ of pages. And sometimes i have problems ...
3
votes
3answers
273 views

Sharing of fail2ban banned IPs

I'm using fail2ban on all servers with publicly visible services and I wonder: Is there an easy way to share banned IPs between hosts I control? Is there a service out there collecting and ...
3
votes
1answer
462 views

is there any valid reason for users to request phpinfo()

I'm working on writing a set of rules for fail2ban to make life a little more interesting for whoever is trying to bruteforce his way into my system. A good majority of the attempts tend to revolve ...
3
votes
1answer
1k views

fail2ban cannot ban ip on all ports if it's already banned for specific port

I'm using a custom filter in fail2ban to search through it's own log and ban an ip after 5 bans from any of the regular filters. I'm using iptables-allports as action for this. All other filters are ...
3
votes
1answer
2k views

How to use fail2ban to parse Nginx access log to count 404's and ban ip addresses?

How can I use fail2ban to parse Nginx access log to count 404's and 502's, and ban ip addresses with too many requests?
2
votes
3answers
2k views

Have fail2ban send notification to banned party

I have fail2ban configured on some CentOS 5 and 6 servers, and it sends me an email with a whois of the IP whenever an IP is banned. Is it possible to configure fail2ban to also send a notification ...
2
votes
2answers
965 views

“Couldn't find package fail2ban”?

Ubuntu Server 9.10 Hi Guys, I think this one is a simple one... I'm trying to install fail2ban and get the following error: $ sudo apt-get install fail2ban Reading package lists... Done Building ...
2
votes
1answer
3k views

Fail2ban unblock ipaddress

I am trying to unblock a IPaddress without restarting fail2ban each time, what is the best way of doing this? Or can you point me in the direction of a useful guide? As you can see below the IP ...
2
votes
3answers
4k views

fail2ban iptables having port 22 and fails to block ssh on custom port

This question is almost same problem like mine but accepted answer doesn't solve my issues In Fail2Ban, How to Change the SSH port number? SSH on port 22 everything works great. After 5 attempts ...
2
votes
2answers
696 views

How to synchronize command calls on Linux

This is my specific problem I need to solve (But my question is different, so please read on even if you don't know what fail2ban is): I'm trying to use fail2ban on a linux server to ban brute force ...
2
votes
1answer
499 views

Tools to block hack attempts in Apache

Currently I'm using Blockhosts & mod_evasive to "manage" minor attacks & spurious requests, I'm wondering if there is something better/more effective out there. Something that behaves like ...
2
votes
1answer
113 views

fail2ban with PermitRootLogin without-password?

I tried to choose a title that cover the topic: Why should I use fail2ban (or similar programs) if I've my PermitRootLogin set to without-password? A very trusted and experienced sysadmin that I ...
2
votes
3answers
673 views

fail2ban bans me after a series of *successful* logins

I created a passwordless ssh login for one of my servers by using the authorized_keys file. The server has fail2ban on it, and I noticed that after several successful logins I could no longer log in ...
2
votes
1answer
290 views

How to properly configure fail2ban to ban IP if it is accessing some wrong files

I am trying to configure fail2ban on my test server. I want just to temporary block any script bots that try to probe my site. So everything that has cgi-bin, admin, setup.php and so on. I previously ...
2
votes
1answer
255 views

Fail2ban not working on Ubuntu

I noticed a bunch of those w00tw00t requests coming to my Ubuntu 12.04 server and so I installed fail2ban. I followed these instructions on setting up Fail2ban against w00tw00t requests. I made sure ...
2
votes
3answers
2k views

Why isn't fail2ban blocking failures?

This below is the output of fail2ban log. Nothing more shows up, but in auth.log I see like hundreds of failures for root user login (someone is bad ass brute forcing). 2011-07-06 01:48:16,249 ...
2
votes
2answers
3k views

fail2ban: stop pop3 login attempts?

How do I set up fail2ban so that all those pesky pop3 login attempts are taken care of? I am using Ubuntu 9.04 and here's an extract from the pop3 log as I see it in the mails that Logwatch sends: ...
2
votes
1answer
1k views

fail2ban to block Wordpress brute force attacks on wp-login.php

Is there a way to set up fail to ban to block on IP that hits wp-login too many times? I have tried adding this jail.local: [apache-wp-login] enabled = true action = iptables[name=wplogin, ...
2
votes
1answer
290 views

custom filter for Fail2Ban

I have installed fail2ban and I am trying to get it set up to block IP addresses that appear in a certain message that appears in the syslog. The message in the syslog is: racoon: ERROR: Invalid ...
2
votes
1answer
67 views

Use of backreferences in fail2ban filters possible?

From time to time, I see collections of suspect "File not found" errors in my Apache logs, basically using the pattern File does not exist: /var/www/file, referer: http://my.server.com/file In ...
2
votes
1answer
2k views

How do I format this regex so it will work in fail2ban?

I've just installed fail2ban on my CentOS server in response to an SSH brute force attempt. The default regular expressions in fail2ban's sshd.conf file do not match any entries in audit.log, which ...