Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

0
votes
1answer
155 views

How to unban from fail2ban?

fail2ban banned my ip for SSH. In email I received that said I got banned via fail2ban after 5 attempts against SSH. Which is not even truth i wasn't even loging to SSH. I can still access webmin. I ...
1
vote
1answer
52 views

Use of backreferences in fail2ban filters possible?

From time to time, I see collections of suspect "File not found" errors in my Apache logs, basically using the pattern File does not exist: /var/www/file, referer: http://my.server.com/file In ...
0
votes
1answer
106 views

fail2ban iptable rule wont block

So I set up fail2ban on my Debian 7 server, still I've been getting hit a lot and I dont know why is not blocking properly. The regex works, it recognizes the attempts but it seems the iptables rules ...
1
vote
0answers
99 views

nginx with fail2ban and mod_security

I forgot to update my fail2ban config for nginx. I just moved to nginx from apache. Today, I got a lot of cals from a single IP. IP tried to access login pages with post and get methods IP tried to ...
2
votes
3answers
784 views

How to block all root login attempts using denyhosts and or fail2ban?

I currently block all ssh logins using root. But I wanted to go the extra mile and block the ip address of the client who tried to login as root. I currently have denyhosts and fail2ban setup and ...
2
votes
2answers
822 views

fail2ban doesn't process jail even though regex matches

I have trouble setting up fail2ban to check the nginx error log for failed http auth entries. Even though the provided failregex works, fail2ban just seems to skip the jail config. I've already tried ...
0
votes
0answers
49 views

Using fail2ban for auth.log POSSIBLE BREAK-IN ATTEMPT!s when on VPN

I've been getting a bunch of reverse mapping checking getaddrinfo for some-long-domain.example.com [X.X.X.X] failed - POSSIBLE BREAK-IN ATTEMPT! on my personal server. It's not as if these ...
2
votes
4answers
246 views

Protect ssh server

I've got a debian-machine running several services, like apache with http and https, jabber and an openssh server for administration. The ssh-server is not running on port 22. It's on something like ...
1
vote
1answer
36 views

Fail2ban still adding to log after uninstall

I am running a CentOS6 VM and I have been playing with Fail2ban, upon removing the service from my server I can see that it appears to be still posting logs to the /var/log/maillog Here is a link a ...
0
votes
0answers
135 views

Fail2ban configure to stop trying to use the server as a proxy

With reference from my question on Flood of traffic on port 25 I have tried to configure Fail2ban to stop trying to use the server as a proxy. In jail.conf, I have added below rule: [nginx-proxy] ...
0
votes
1answer
405 views

Why fail2ban 0.8 doesn't start properly on Debain 7 Wheezy x64?

Why fail2ban 0.8 doesn't start properly on Debain 7 Wheezy x64? Hi, I'm trying to configure fail2ban to work with APF. But first, it would be great if fail2ban can start. root@akdom:/var/log# ...
0
votes
1answer
119 views

fail2ban block retry count always changes

As title mentions clearly, fail2ban block retry count always changes. I set all retry counts to 3; but sometimes it blocks me after 6 or 7 retries. How can set its behavior a constant value? I added ...
1
vote
1answer
194 views

Does fail2ban monitor rotated log files?

Does fail2ban continue to monitor rotated log files? For example, I have a rule monitoring /var/log/fail2ban.log which is automatically rotated by the system every week (7 days). I want to have a ...
0
votes
1answer
57 views

fail2ban doesnt permanently block

Fail2ban doesn't seem to block permanently. I have bantime =-1 but if i look a bit later on my iptables its just not there anymore all ill see is Chain fail2ban-ssh (1 references) target prot ...
0
votes
0answers
679 views

Fail2Ban + BIND to ban “DNS format error from X.X.X.X resolving something.com/MX for client Y.Y.Y.Y: invalid response” or not to ban?

Recently, the increased load on the DNS, to log a lot of records like this: 14-Aug-2013 17:14:22.834 resolver: notice: DNS format error from 204.13.160.143#53 resolving palactive.com/MX for ...
2
votes
3answers
2k views

fail2ban iptables having port 22 and fails to block ssh on custom port

This question is almost same problem like mine but accepted answer doesn't solve my issues In Fail2Ban, How to Change the SSH port number? SSH on port 22 everything works great. After 5 attempts ...
0
votes
1answer
392 views

How to block Bad robots, spiders, crawlers and harvesters

I'm sick and tired of this bad robots, spiders, crawlers and harvesters. I have already configured my server to block IP connected for 5 minutes and with maxretry of 250 using fail2ban. But still some ...
1
vote
0answers
126 views

How to Exclude Log Using Fail2Ban logpath with Wildcard Settings

I'm using wildcard in the logpath value as shown below: [http-get-dos] enabled = true filter = http-get-dos logpath = /var/log/ispconfig/httpd/*/access.log maxretry = 250 findtime = 300 #ban for 10 ...
1
vote
3answers
915 views

Fail2Ban on Apache Server to protect against DoS attacks?

I asked a question on the IT security StackExchange about protecting against DoS attacks. One of the answers was to install Fail2Ban. I talked to the people that administer the server and they told ...
5
votes
2answers
1k views

Why is iptables not blocking an ip address?

I have configured fail2ban to monitor a certain pattern of malicious traffic I'm getting and ban IP addresses associated. Everything seems to be working great -- the regex is matching the pattern ...
0
votes
0answers
335 views

fail2ban is failing to ban apache IP pattern

I just noticed that fail2ban reports it 'banned' an IP address doing the following: 183.60.48.25 - - [03/Jul/2013:10:14:26 -0700] "GET http://www.baidu.com/ HTTP/1.1" 200 5112 183.60.48.25 - - ...
4
votes
4answers
7k views

In Fail2Ban, How to Change the SSH port number?

In my server, the ssh port is not the standard 22. I have set a different one. If I setup fail2ban, will it be able to detect that port? How can I tell it to check that port rather than port 22? The ...
1
vote
1answer
307 views

How to add a jail for specific IPs in fail2ban?

I would like to add a specific list of IPs for which I would like to get an email from Fail2ban after they make a couple of "GET" requests. The pattern to look for in apache's access logs is ^1.2.3.4 ...
0
votes
1answer
1k views

Fail2ban not configuring properly

I have just installed a fresh version of iptables followed by fail2ban, but fail2ban fails to do anything with iptables and I am stuck with no changes being made, this fail2ban not working properly. ...
0
votes
0answers
558 views

How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?

Fail2Ban on Ubuntu 10.04 Configuration files /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1 bantime = 10 # made for test purposes maxretry = 3 backend = polling destemail = ...
0
votes
0answers
259 views

How to protect Nginx from HULK DoS tool

There is a tool called HULK (Http Unbearable Load King). It's a web server denial of service tool. It is designed to generate volumes of unique and obfuscated traffic at a webserver, bypassing caching ...
1
vote
2answers
192 views

Strange java user agent in access.log

I recently noticed a huge load on my main production server, after some log parsing i stumbled upon a large number of those user agents originate from about 20 different IPs: 173.244.182.194 - - ...
1
vote
2answers
297 views

Is there any reason to use fail2ban with SSH password logins disabled?

I am setting up an Ubuntu server hosted by Linode. I am stepping through their security guide and they recommend installing fail2ban after disabling password based SSH logins. I don't see the point ...
0
votes
1answer
458 views

Anti-DDos Apache2 Fail2ban regex rule [duplicate]

I have fail2ban up and running, but my Failregex doesnt match anything, something is wrong. Request which i like to ban look like this: 186.6.65.199 - - [06/May/2013:18:46:21 +0400] "GET / HTTP/1.1" ...
5
votes
1answer
2k views

Custom fail2ban Filter for phpMyadmin bruteforce attempts

In my quest to block excessive failed phpMyAdmin login attempts with fail2ban, I've created a script that logs said failed attempts to a file: /var/log/phpmyadmin_auth.log Custom log The format of ...
0
votes
1answer
84 views

Run fail2ban without banning

It is possible to run fail2ban in some kind of "simulation mode" so it does not ban but log somewhere who it would have ban? Running fail2ban on Ubuntu 12.04. Thanks
0
votes
0answers
166 views

Fail2ban fails to parse logs, no error, no warning, no banning on CentOS

Using latest build (0.8.8) on CentOS i've setup fail2ban to filter Kerio spam/harvest attacks. Here's my kerio.conf [INCLUDES] before = common.conf [Definition] failregex = .*SMTP connection from ...
2
votes
2answers
101 views

Can Fail2Ban recognise failed logins to locked accounts?

I have locked the root account on my server with passwd -l root and so an attempted login results in the following in /var/log/auth.log: User root not allowed because account is locked Fail2Ban ...
4
votes
1answer
1k views

Installing from EPEL on Amazon EC2

I am trying to install fail2ban on our Amazon EC2 Linux AMI (CentOS). I know that fail2ban is in the EPEL so I have done the following: wget ...
1
vote
2answers
2k views

Connection refused after installing vsftp on Ubuntu 8.04 with fail2ban

I have been using an Ubuntu 8.04 server with fail2ban for a while now (12+ months) and using ftp over SSH without any problems. I have a new user that needs to put files onto the server from an IP ...
1
vote
0answers
100 views

Fail2ban on Ubuntu 11.10 does not ban custom filter/jail

An application I'm running logs incorrect logins such as this: Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 ...
3
votes
1answer
889 views

fail2ban cannot ban ip on all ports if it's already banned for specific port

I'm using a custom filter in fail2ban to search through it's own log and ban an ip after 5 bans from any of the regular filters. I'm using iptables-allports as action for this. All other filters are ...
1
vote
2answers
600 views

How to synchronize command calls on Linux

This is my specific problem I need to solve (But my question is different, so please read on even if you don't know what fail2ban is): I'm trying to use fail2ban on a linux server to ban brute force ...
3
votes
1answer
2k views

How to set up fail2ban to read multi log in a jail?

How can I configure multiple logpaths for the same rule? I'm trying to write a syntax like this: [apache-w00tw00t] enabled = true filter = apache-w00tw00t action = iptables-allports logpath = ...
7
votes
3answers
4k views

How do I setup monitoring of MySQL with Fail2ban?

Searching the internet with search engines on MySQL and fail2ban yields lots of results on putting your fail2ban logs into MySQL, however I'm wanting to monitor failed MySQL attempts to log in and ban ...
1
vote
2answers
400 views

Setting up fail2ban to ignore connections behind a dynamic IP

Using fail2ban to secure an Ubuntu 12.04 x64 Server on DigitalOcean, while editing /etc/fail2ban/jail.local there's this part: [DEFAULT] # "ignoreip" can be an IP address, a CIDR mask or a DNS host ...
2
votes
2answers
2k views

Fail2Ban - how to prevent my ISP IP dynamic get banned?

I have just installed Fail2Ban. I want to add my ISP IP to my ignore list but my IP is dynamic. In the jail.conf file, I have like this: [DEFAULT] # "ignoreip" can be an IP address, a CIDR mask or ...
-1
votes
1answer
450 views

Fail2ban memory usage

Since my server is under a sustain DNS amplification attack (DDOS), I configured fail2ban and initially my outgoing traffic dropped markedly. Anyway, after a few hours (mostly +10), fail2ban uses ...
4
votes
1answer
1k views

measures to take against a dns amplification attack

I recently discovered that my server was being used as part of a DNS DDOS. Basically, my BIND setup allowed recursion, and it was used to attack a certain IP address using IP spoofing. I took the ...
1
vote
1answer
226 views

Do we need PSAD if we already have Fail2Ban?

I already have installed Fail2Ban on my server. I planned to install PSAD on it. Are they equal? Isn't it a good idea to keep them both?
0
votes
1answer
578 views

Fail2Ban adds iptable rules but they are not working?

Fail2Ban just blocked my IP for 3 SSH attempts. It added the iptables rule and I can see it using the "sudo iptables -L -n" command. But I can still access the site and login through SSH! What might ...
2
votes
2answers
221 views

fail2ban-apache not blocking IP

I'm trying to configure fail2ban, I attempted to log into my web server numerous times to trigger the rule and looking at my iptables it seems to have worked: Chain fail2ban-apache (1 references) ...
1
vote
3answers
2k views

Setting up fail2ban to ban failed phpMyAdmin login attempts

We've been using fail2ban to block failed ssh attempts. I would like to setup the same thing for phpMyAdmin as well. As phpMyAdmin doesn't log authentication attempts to a file (that I know of), I'm ...
2
votes
2answers
459 views

iptables with Cloudflare

I'm using fail2ban to block web vulnerability scanners. It is working correctly when visiting the site if CloudFlare is bypassed, but a user can still access it if going through it. I have ...
-2
votes
2answers
420 views

Is it a good idea to disable Nginx access logs when it comes to security?

According to a blog post I found, disabling Nginx access log can speed things up. Nginx have to write to this file every time some one access the site. But, when setting up fail2ban, I realized that ...