Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

4
votes
4answers
960 views

fail2ban bans me after a series of *successful* logins

I created a passwordless ssh login for one of my servers by using the authorized_keys file. The server has fail2ban on it, and I noticed that after several successful logins I could no longer log in (...
0
votes
0answers
44 views

Nagios check_log reset to OK after notification

Fail2ban is installed on one of the servers, I'm able to ban every IP that try to log in. I'm using the check_log plugin of Nagios to capture the last line of the fail2ban.log, it compares to the ...
3
votes
1answer
155 views

Should i use Firewalld or Iptables for Fail2ban in Centos 7?

I'm setting up Fail2ban to protect ssh, and I use firewalld, I saw a lot of people recommending to use anaction = iptables-multiport and other solutions using iptables instead of firewalld claiming ...
0
votes
1answer
73 views

Unable to reinstall fail2ban after completly removing it from Centos 7

After completely removing Fail2ban from Centos 7, I decided to reinstall it. So I run the installation(yum), and everything seems ok, no errors, But the it seems like the installation does not create ...
0
votes
0answers
41 views

fail2ban doesnt read log if file being used

My environment is Ubuntu 14.04, LAMP stack all from apt. implemented fail2ban and configured jail.local with backend = auto [ssh] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log ...
0
votes
0answers
96 views

Issue with Fail2ban and Mikrotik Firewall

OS: CentOS 7.1 At my organization we are currently assessing using Fail2ban with the firewall on our Mikrotik router. I want Fail2ban to communicate any IP flagged as banned to the Mikrotik firewall,...
1
vote
1answer
107 views

Fail2Ban regex to match these lines?

I've been trying to get fail2ban to work with the Xeams email spam filter. But, I can't figure out what possible regex I should use to match the logs. The logs are in this format. 61.240.144.65 ...
0
votes
1answer
52 views

Fail2ban with Hipchat server

Has anyone managed to get fail2ban working with hipchat server? I've found the log file and here's an example of a failure; Authentication for 'user@domain.com' failed. HTTP code: 403, XMPP error: ...
1
vote
1answer
57 views

Fail2Ban regex is wrong?

I'm currently setting up a filter to filter POST attacks on a file named xmlrpc.php. Requests that should be monitored in the log access look like: 1.99.437.201 - - [01/Feb/2016:01:57:14 +0000] "POST ...
1
vote
2answers
222 views

Configure Fail2ban for SSH and ldap

I have a fail2ban Installation on two Centos7 machine. And I want to secure SSH with it so I installed (The SSH protecting seems active) and set the allowed pw-fails to 5 and I left the banntime at ...
0
votes
2answers
564 views

How to check if firewalld is blocking an incoming ip address?

I have CentOS 7 with firewalld. I installed fail2ban and using the firewallcmd-new action. I am seeing bans in the fail2ban logs, and I want to check in firewallcmd if they are blocked. How can I do ...
0
votes
1answer
113 views

why fail2ban does not ban? (ubuntu, ssh)

I installed a fresh Ubuntu machine. Then I changed the ssh port which is no more 22 but 22111: Then I have installed fail2ban: apt-get install fail2ban -y cp /etc/fail2ban/jail.conf /etc/fail2ban/...
0
votes
1answer
37 views

CentOS server blocking own outgoing traffic

I've got a server (CentOS 6.7) running, which causes me some headaches. A few months ago, the website running on the server was unavailable. After some digging, it appeared that Iptables was blocking ...
1
vote
0answers
37 views

How do I specify multiple logfiles for a jail in fail2ban?

Heyo, I'm using Ubuntu 15.10 and fail2ban 0.9.3. Apache is set up with a bunch of Apache virtualhosts. I have my Apache2 logfiles located in subdirectories, one per localhost, e.g. '/var/log/apache2/...
-1
votes
2answers
254 views

How can I reject spam before reaching SMTP on Postfix

My server has started receiving thousands of attempts to use my mail server to send spam from dynamic.hinet.net. The attempts are always rejected, but it's non-stop. I'd like to block these attempts ...
0
votes
0answers
19 views

Linking fail2ban with a RDBMS

I would like to maintain a highly dynamic RDBMS table that will be insert/update/deleted from from multiple hosts (a kind of global blacklist for all my servers). The table would have a couple basic ...
0
votes
1answer
48 views

Fail2Ban blocks ip in ignoreip list

Fail2ban continues to block an ip even after I have whitelisted that ip. I have in /etc/fail2ban/jail.conf a line like the following. ignoreip = 53.45.114.103 However fail2ban continues to block ...
1
vote
0answers
116 views

How to detect SMTP AUTH attempts in Fail2Ban?

I have a Fail2Ban jail that monitors failed SASL authentications to my Postfix SMTP server. When this occurs, /var/log/mail.log contains these three lines: postfix/smtpd[32591]: connect from unknown[...
8
votes
7answers
12k views

Stop fail2ban stop/start notifications

If the server is restarted, or even if fail2ban is stopped/start it sends a notification. [asterisk-iptables] enabled = true filter = asterisk action = iptables-allports[name=ASTERISK, protocol=...
2
votes
1answer
281 views

Fail2Ban not banning IPs with different ports

I am getting different SSH attacks from the same IPs and they are getting banned. But they are using a different port and all they have to do is change the port to bypass the ban. Dec 28 23:16:57 ...
0
votes
1answer
374 views

How to mitigate DDOS attacks on AWS?

I have web application (NodeJS) and I plan to deploy it to AWS. To minimize the cost it will run on single EC2 instance. I'm worried though about what will happen if someone decides to bless me with ...
0
votes
0answers
21 views

Cannot get fail2ban failregex to match log

This is the failregex ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",...
1
vote
1answer
98 views

Is fail2ban not matching these lines just because of the port?

I would like fail2ban to engage against these lines and block the example IP address included: [Tue Dec 08 12:17:13.622175 2015] [:error] [pid 30390] [client 62.210.88.201:38139] script '/var/www/...
-1
votes
1answer
95 views

Is fail2ban necessary? [closed]

I have disabled the root login, disabled the password authentication option, and blocked all ports except 22 and 80 for a linux virtual server I run. The only way to access the server is with a 4096 ...
0
votes
2answers
111 views

Fail2ban not banning after update to latest version

I was running fail2ban 0.8.11 which is the version installed on Ubuntu 14.04 with apt-get. I downloaded and installed the latest source, 0.93. When I start it up, I get two error messages. WARNING ...
3
votes
2answers
620 views

Does fail2ban monitor rotated log files?

Does fail2ban continue to monitor rotated log files? For example, I have a rule monitoring /var/log/fail2ban.log which is automatically rotated by the system every week (7 days). I want to have a ...
1
vote
0answers
45 views

How do I set Host Groups on Fail2ban for Wordpress?

I'm trying to set up a custom filter for fail2ban on a wordpress site. I've been following this tutorial but when I try to test my custom filter, I get the error: server.failregex.RegexException: No '...
2
votes
1answer
56 views

fail2ban rules not coming into effect

I have installed the Apache web server on a stock installation of Ubuntu 14.04, and I am trying to use fail2ban to block requests that check for vulnerabilities. I have put the following in /etc/...
9
votes
3answers
5k views

Fail2Ban: already banned?

I have Fail2Ban running on my Centos Server. (Config below) In my var/log/messages I noticed something really weird: Jun 19 12:09:32 localhost fail2ban.actions: INFO [postfix] 114.43.245.205 ...
1
vote
1answer
32 views

fail2ban BANTIME not working for SASL

My fail2ban bantime does not appear to be working. I still get repeated ban notifications from the same IP within 45 minutes of each other. My bantime is set to 24 hours. [sasl] enabled = true port ...
-1
votes
1answer
74 views

Can I use the following Fail2ban jail with my wordpress on nginx server?

[nginx-noscript] enabled = true port = http,https filter = nginx-noscript logpath = /var/log/nginx/access.log maxretry = 6 It is advised to not enable [nginx-noscript] jail, if server is ...
38
votes
8answers
35k views

Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

I'm setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I've seen many recommendations for both denyhosts and fail2ban, but few comparisons of the two....
1
vote
1answer
52 views

fail2ban for apache access log

I have tried all the approaches I know of to get the host from the apache access log but none have worked my basic testing approach is as follows: fail2ban-regex '87.97.244.57 - - [05/Nov/2015:12:46:...
0
votes
0answers
60 views

Fail2Ban emails not showing extracts from Apache logfiles

I have recently set up Debian Jessie on a server for the first time. 'Obviously' fail2ban was set up very early in the process. It is banning IP addresses and sending me emails ok, but the Apache-...
3
votes
2answers
611 views

fail2ban.action ERROR iptables -w -N f2b-<jail-name>

I've been using fail2ban for a while without any issues. The other day, I decided to stop fail2ban to remove one rule from my default iptables. When I started fail2ban, it started ok (according to ...
1
vote
0answers
11 views

Anomalous iptables entry with fail2ban (is it misconfigured to block outward traffic?)

Overall we are very satisfied with fail2ban as it has accumulated several dozen neverdowell IP addresses in our iptables rules. However I notice the following rule has also appeared: Chain fail2ban-...
0
votes
1answer
292 views

Fail2Ban plug-in is enabled in Munin but the graph images are broken. How to fix?

I recently installed Fail2Ban on an Ubuntu 12.04.5 server and it’s working great. Now I want to setup Munin so it can monitor it and generate graphs/reports. I found that Munin has a built-in Fail2Ban ...
2
votes
1answer
482 views

How can I upgrade Fail2Ban in Ubuntu 12.04.5 LTS to get the “recidive” filter installed?

Basic question. How can I install an upgraded version of Fail2Ban on my Ubuntu 12.04.5 LTS (Precise Pangolin) so I can have a recidive filter set. Ubuntu 12.04.5 LTS installs Fail2Ban 0.8.6 and I ...
4
votes
1answer
1k views

How do I automatically ban UDP short packet with Fail2Ban?

This logfile /var/log/kern.log contains some IP addresses, which I would like the system to automatically ban/block. Basicaly, a packet is from the UDP protocol, and is a short packet, then I would ...
2
votes
3answers
315 views

fail2ban-apache not blocking IP

I'm trying to configure fail2ban, I attempted to log into my web server numerous times to trigger the rule and looking at my iptables it seems to have worked: Chain fail2ban-apache (1 references) ...
1
vote
1answer
493 views

Configuring varnish to write an apache error log with IP addresses

I am in the process of installing fail2ban on a webserver which runs Varnish. Many on the 'jails' require access to the apache/php error logs. One of the problems I have is that all of the refernces ...
1
vote
1answer
83 views

What are the differences between Fail2Ban and BFD (Brute Force Detection)

I have used both Fail2Ban and BFD, typically I go with Fail2Ban on servers running IPTables, and BFD when servers are running APF. Are there any major differences between these 2 services? What are ...
0
votes
1answer
123 views

Determining e-mail server blacklisting from log files

I have my self-hosted e-mail server. There is no current problem of being blacklisted but I want to be proactive about it and I want to start with the log files. There have been some entries in my ...
5
votes
0answers
2k views

Fail2Ban Correctly Attempts to Ban IP but IP does not get banned - iptables chain exists but not working

Running on Ubuntu 14.04 Server. So I have fail2ban correctly configured to process /var/log/auth.log for SSH login attempts. Upon 3 failed attempts I see this in the fail2ban log: 2014-11-19 15:...
0
votes
1answer
158 views

Change the order that an IPTABLE CHAIN is read (Using Fail2Ban)

I have some experience using iptables and fail2ban. Both are working as they should, but I would like to optimize the way packets are "DROPed" when IP & port probing occur. Fail2Ban is doing a ...
0
votes
1answer
153 views

Fail2ban: regex test succeed but fail2ban does not ban any IP

I can't ban any ip, thought when I test my regex, it has +2000matches: > fail2ban-regex '/var/log/nginx/access.log' '/etc/fail2ban/filter.d/bad-request.conf' Date template hits: |- [# of hits] ...
0
votes
0answers
11 views

How do I install fail2ban on CentOs 6.7? “Package will be installed… Killed” [duplicate]

I'm getting an error when I try to install it. [root@showcarpic ~]# rm -f /var/lib/rpm/__db* [root@showcarpic ~]# yum clean all Loaded plugins: fastestmirror Cleaning repos: base epel extras newrelic ...
1
vote
1answer
107 views

SELinux preventing Fail2Ban from emailing notification via msmtp

I have msmtp as a null client connecting to my AWS SES account for SMTP, delivering alerts such as cron, monit and soon hopefully Fail2Ban to my email addresses. However, Fail2Ban isn't playing ball, ...
0
votes
0answers
187 views

Fail2Ban Cannot Read NginX Log Files - SELinux - ERROR No file(s) found for glob

I've been having issues with this on and off and I've exhausted my abilities on this. It's a CentOS7 system with SElinux enabled. Fail2Ban works for most jails just fine, very happy with it. My ...
1
vote
0answers
114 views

Fail2Ban regex in sshd.conf not catching failed root logins in /var/log/auth.log

I used Fail2Ban on my Ubuntu server (14.04 LTS), and it mostly works well. I recently noticed the default regex in /etc/fail2ban/filter.d/sshd.conf does not match some failed sshd login attempts. ...