Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

0
votes
1answer
72 views

SELinux problems running Expect script from fail2ban

I have an Expect script that works fine if I run it manually, but fails when run as an action from Fail2ban. The error message is as follows: spawn /usr/bin/telnet 192.168.242.1 The system has no ...
4
votes
5answers
5k views

Stop fail2ban stop/start notifications

If the server is restarted, or even if fail2ban is stopped/start it sends a notification. [asterisk-iptables] enabled = true filter = asterisk action = iptables-allports[name=ASTERISK, ...
0
votes
1answer
535 views

fail2ban not working on apache Ubuntu

Nothing happens even though it detects in the logs. It does not block the IP. It works fine forVSFTP but not for apache. Please help. You can see the config and log below. jail.local config file: ...
2
votes
1answer
1k views

fail2ban to block Wordpress brute force attacks on wp-login.php

Is there a way to set up fail to ban to block on IP that hits wp-login too many times? I have tried adding this jail.local: [apache-wp-login] enabled = true action = iptables[name=wplogin, ...
4
votes
2answers
140 views

What is the optimum ban duration of a brute force attack?

I use fail2ban to prevent brute force attacks on my production servers. Fail2ban bans an ip after 5 authentication failure and unbans it after 1 hour with my own configuration. I wonder that what is ...
0
votes
1answer
123 views

SecAst blocking IP's that fail2ban is not

I'm using SecAst on my Asterisk server as well as fail2ban. (Setup as an option as per the SecAst installation guide). I did this to test if SecAst is working right. I planned to remove fail2ban if ...
2
votes
1answer
30 views

Preventing SecAst access from across the network

I have SecAst up and running great, and I realize that any workstation on the network can access the SecAst telnet interface. Is there a way to limit this to only my laptop? I don't want one of the ...
-1
votes
2answers
212 views

Fail2Ban Regex - Joomla / PHP5-FPM

i can't get a regex for fail2ban to work. I want to match the following: [Tue Jun 24 10:22:14.528987 2014] [fcgid:warn] [pid 22526:tid 139757615011584] [client IP:PORT] mod_fcgid: stderr: user admin ...
-1
votes
1answer
119 views

iptables: REJECT not working, but DROP does

I have recently setup a server with fail2ban, and it is mostly working except I am getting errors whenever this command tries to execute: sudo iptables -D fail2ban-ssh -s xxx.xxx.xxx.xxx -j REJECT ...
2
votes
1answer
219 views

How does fail2ban 0.9 database storage actually works?

Fail2ban 0.9 introduce database storage to save bans on restart. But I can't find out the actual mechanism of it work. There is dbpurgeage parameter which controls lifetime of old bans, defaults to ...
1
vote
4answers
86 views

Securing debain with fail2ban or iptables

I'm looking to secure my server. Initially my first thought was to use iptables but then I also learnt about Fail2ban. I understand that Fail2ban is based on iptables, but it has the advantages of ...
1
vote
1answer
563 views

fail2ban regex working but no action being taken

I have the following snippet of fail2ban configuration on Ubuntu 13.10 server: #jail.conf [apache-getphp] enabled = true port = http,https filter = apache-getphp action = ...
2
votes
3answers
2k views

Have fail2ban send notification to banned party

I have fail2ban configured on some CentOS 5 and 6 servers, and it sends me an email with a whois of the IP whenever an IP is banned. Is it possible to configure fail2ban to also send a notification ...
1
vote
2answers
139 views

All nginx access logs from 127.0.0.1 (so can't use fail2ban)

Problem I'm trying to configure fail2ban to block ddos attacks using the chunk shown here. Basically it looks at all requests and if any single IP makes more than 240 requests over 60 seconds it ...
0
votes
1answer
2k views

Fail2Ban can't insert iptables rule

It seems my fail2ban can't ban a host: 2013-06-22 18:18:24,546 fail2ban.actions.action: ERROR iptables -n -L INPUT | grep -q fail2ban-apache-noscript returned 100 2013-06-22 18:18:24,546 ...
2
votes
1answer
298 views

How to properly configure fail2ban to ban IP if it is accessing some wrong files

I am trying to configure fail2ban on my test server. I want just to temporary block any script bots that try to probe my site. So everything that has cgi-bin, admin, setup.php and so on. I previously ...
1
vote
2answers
167 views

Fail2ban and X-Forwarded

I am configuring fail2ban on my webservers. My Webservers are behind ELB. so I configured X-forwarded to get the real IP's in Apache Access logs.But unfortunately fail2ban not able scan accesslogs ...
1
vote
1answer
398 views

fail2ban-regex matches with strings, but not with log and conf files, why?

If I run fail2ban-regex '31.22.105.115 - - [11/Apr/2014:18:09:54 +0100] "GET /admin/config.php HTTP/1.0" 301 573 "-" "-"' '^<HOST> - - (?:\[[^]]*\] ...
2
votes
1answer
114 views

fail2ban with PermitRootLogin without-password?

I tried to choose a title that cover the topic: Why should I use fail2ban (or similar programs) if I've my PermitRootLogin set to without-password? A very trusted and experienced sysadmin that I ...
2
votes
2answers
993 views

Fail2ban log filled with entries saying “fail2ban.filter : WARNING Determined IP using DNS Lookup:..”

My fail2ban log at /var/log/fail2ban.log is completely filled with entries saying: fail2ban.filter : WARNING Determined IP using DNS Lookup: [IP address] I think this may have begun after I changed ...
0
votes
1answer
300 views

fail2ban not banning, time is off, how do I sync them?

In searching for why fail2ban is not banning patterns, I found that when I run /etc/init.d/fail2ban status it reports over an hour behind my 'date' command. 'date' says its: Tue Mar 18 20:45:02 MST ...
1
vote
1answer
874 views

fail2ban bad bots apache access log regex

Trying to block some bad bots using fail2ban reading Apache access log and stuck setting up correct regex. The line I want to match in the access log is: 5.10.83.65 - - [18/Mar/2014:09:06:38 +0400] ...
1
vote
1answer
34 views

How to configure fail2ban for constant refreshes

I have a page that shows election results. Some people who want to see these election results will keep clicking refresh as election night goes on. I don't want to block this traffic -- but I do want ...
2
votes
0answers
377 views

fail2ban fails to block from auth.log with directadmin

i'm using directadmin on a Ubuntu server. i recently installed Fail2Ban. but i'm still recieving "Brute-Force attack" email from directadmin. my jail.conf (only the auth.log jails!): [ssh] enabled ...
1
vote
2answers
610 views

fail2ban rule results in “iptables returned 200” error message

I just tried to add a new fail2ban rule that is supposed to scan Apache2 error logs for suspicious file access attempts (People who try to access three common login urls that do not exist usually ...
1
vote
1answer
754 views

fail2ban jail not firing

Used fail2ban in a few different methods, and have now tried to get it to block hack attempts via smtp for sending spam through server. Regex matches ok when testing: Failregex |- Regular ...
2
votes
1answer
295 views

custom filter for Fail2Ban

I have installed fail2ban and I am trying to get it set up to block IP addresses that appear in a certain message that appears in the syslog. The message in the syslog is: racoon: ERROR: Invalid ...
-3
votes
2answers
1k views

Logrotate error for fail2ban

I get the following error when running a cron job, and I'm not too sure how to go about fixing. This is on Ubuntu 12.04 LTS. test -x /usr/sbin/anacron || ( cd / && run-parts --report ...
0
votes
1answer
877 views

Postfix fail2ban help.. I have a bad host but fail2ban won't block him

Hi I am using postfix plus fail2ban on Centos 6.5 but I am getting botted (I am not relaying but there you go) and for some reason fail2ban isn't able to cut the ip and block it this is 6/7 times a ...
0
votes
0answers
235 views

Fail2Ban Apache-noscript failing to block script as referer

I am receiving a number of apache not found or unable to stat and would like to block these IP addresses using Fail2Ban. [Fri Feb 28 03:36:51.816955 2014] [:error] [pid 29027] [client ...
0
votes
1answer
2k views

Fail2Ban not blocking brute force attack on dovecot

I run a CentOS 5 server with fail2ban and I am currently getting hit with a bruteforce attack on my dovecot service. I know fail2ban is working, because it is blocking attacks on my FTP server and ...
2
votes
1answer
257 views

Fail2ban not working on Ubuntu

I noticed a bunch of those w00tw00t requests coming to my Ubuntu 12.04 server and so I installed fail2ban. I followed these instructions on setting up Fail2ban against w00tw00t requests. I made sure ...
0
votes
1answer
627 views

Fail2ban won't start via /etc/init.d/fail2ban but will via /usr/bin/fail2ban-client

I've been running fail2ban successfully for a long time on RHEL. Now all of a sudden starting, stopping and restarting via /etc/init.d/fail2ban no longer works: # /etc/init.d/fail2ban start Starting ...
3
votes
2answers
1k views

fail2ban custom action to permanent ban IPs from China

When a IP address gets banned how can I check if the banned IP address is from China. If yes, then add it to the permanent ban list. I have found this nice guide which write the banned IP to file. ...
2
votes
1answer
2k views

fail2ban for windows 2008 RDP [duplicate]

I'm looking for a solution to make remote desktop more secure. I'm looking for a fail2ban like for windows and specially for RDP which will block IP in firewall after N failed retries Any help?
0
votes
1answer
108 views

fail2ban receiving events but not triggering event

I have setup fail2ban to monitor a service which I have exposed outside my router. The files are being logged properly, and the events are being picked up by fail2ban 2013-11-21 01:05:24,573 ...
0
votes
1answer
498 views

Use fail2ban for Samba

I'm looking for a way to use fail2ban to control/block samba logins on Ubuntu 12.04.3 LTS. I already set up an jail.local. The samba part currently looks like this: [samba] enabled = true port = ...
0
votes
1answer
280 views

Fail2ban restarts every day

In my server I can see that the fail2ban restarts every day. While checking the internet I can see that the logrotate causes this. I have disabled the logrotate of fail2ban by removing the fail2ban ...
0
votes
1answer
367 views

Point fail2ban to new log, without losing current bans?

I have logs in /var/log/syslog/YYYY-MM-DD/file.log files. New directories are created automatically by rsyslog, and logs are automatically put to new locations. Every day, I archive previous day of ...
0
votes
1answer
120 views

How to configure fail2ban so it bans login attempts based on the structure of the attempted password or username

I want to set up two filters for fail2ban: If the user tries to login with a password that is less than 10 characters ban them. And if the user tries to login with a password that is more than 10 ...
0
votes
2answers
2k views

fail2ban apache-noscript not working

My debian server has come under attack recently and I've been poring over the logs to see what I can do to harden it. I've been running fail2ban for a while but I've noticed the apache-noscript jail ...
1
vote
1answer
137 views

fail2ban jail not working properly

I'm trying to block non-available script requests to nginx with fail2ban. # Noscript filter /etc/fail2ban/filter.d/nginx-noscript.conf: # # Block IPs trying to execute scripts such as .php, .pl, ...
1
vote
1answer
429 views

fail2ban ignoreip DNS host example?

I would like to add ".googlebot.com" to the ignore iplist for fail2ban since the ignoreip explanation mentions DNS host as an accepted input. Is this a proper format? # "ignoreip" can be an IP ...
0
votes
0answers
264 views

Blocking X-forwarded-For IP in fail2ban?

I am using a reverse proxy in front of my web-server. In the web server I installed fail2ban and want to use it to monitor logs and block bad ip. I am using nginx with the http realip module. But ...
3
votes
1answer
119 views

Fail2ban settings after changing ssh port

I switched my ssh port to 22000 and I changed the port settings in /etc/fail2ban/jail.local to specify to ban on both 22 and 22000 but when I tried failing to login 6 times, my connection was cutoff ...
0
votes
1answer
285 views

How to unban from fail2ban?

fail2ban banned my ip for SSH. In email I received that said I got banned via fail2ban after 5 attempts against SSH. Which is not even truth i wasn't even loging to SSH. I can still access webmin. I ...
2
votes
1answer
67 views

Use of backreferences in fail2ban filters possible?

From time to time, I see collections of suspect "File not found" errors in my Apache logs, basically using the pattern File does not exist: /var/www/file, referer: http://my.server.com/file In ...
0
votes
1answer
150 views

fail2ban iptable rule wont block

So I set up fail2ban on my Debian 7 server, still I've been getting hit a lot and I dont know why is not blocking properly. The regex works, it recognizes the attempts but it seems the iptables rules ...
1
vote
0answers
142 views

nginx with fail2ban and mod_security

I forgot to update my fail2ban config for nginx. I just moved to nginx from apache. Today, I got a lot of cals from a single IP. IP tried to access login pages with post and get methods IP tried to ...
2
votes
2answers
933 views

fail2ban doesn't process jail even though regex matches

I have trouble setting up fail2ban to check the nginx error log for failed http auth entries. Even though the provided failregex works, fail2ban just seems to skip the jail config. I've already tried ...