Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

0
votes
1answer
218 views

Fail2ban restarts every day

In my server I can see that the fail2ban restarts every day. While checking the internet I can see that the logrotate causes this. I have disabled the logrotate of fail2ban by removing the fail2ban ...
0
votes
1answer
110 views

How to configure fail2ban so it bans login attempts based on the structure of the attempted password or username

I want to set up two filters for fail2ban: If the user tries to login with a password that is less than 10 characters ban them. And if the user tries to login with a password that is more than 10 ...
1
vote
1answer
118 views

fail2ban jail not working properly

I'm trying to block non-available script requests to nginx with fail2ban. # Noscript filter /etc/fail2ban/filter.d/nginx-noscript.conf: # # Block IPs trying to execute scripts such as .php, .pl, ...
1
vote
1answer
331 views

fail2ban ignoreip DNS host example?

I would like to add ".googlebot.com" to the ignore iplist for fail2ban since the ignoreip explanation mentions DNS host as an accepted input. Is this a proper format? # "ignoreip" can be an IP ...
0
votes
0answers
224 views

Blocking X-forwarded-For IP in fail2ban?

I am using a reverse proxy in front of my web-server. In the web server I installed fail2ban and want to use it to monitor logs and block bad ip. I am using nginx with the http realip module. But ...
2
votes
2answers
624 views

Fail2ban log filled with entries saying “fail2ban.filter : WARNING Determined IP using DNS Lookup:..”

My fail2ban log at /var/log/fail2ban.log is completely filled with entries saying: fail2ban.filter : WARNING Determined IP using DNS Lookup: [IP address] I think this may have begun after I changed ...
3
votes
1answer
105 views

Fail2ban settings after changing ssh port

I switched my ssh port to 22000 and I changed the port settings in /etc/fail2ban/jail.local to specify to ban on both 22 and 22000 but when I tried failing to login 6 times, my connection was cutoff ...
0
votes
1answer
102 views

fail2ban receiving events but not triggering event

I have setup fail2ban to monitor a service which I have exposed outside my router. The files are being logged properly, and the events are being picked up by fail2ban 2013-11-21 01:05:24,573 ...
0
votes
2answers
2k views

fail2ban apache-noscript not working

My debian server has come under attack recently and I've been poring over the logs to see what I can do to harden it. I've been running fail2ban for a while but I've noticed the apache-noscript jail ...
5
votes
1answer
140 views

How to *add* rules in local fail2ban filter definition?

I have installed fail2ban as packaged by Debian on a server under my control. Since I have some failregexes from before, I'm putting those into the local filter definition file so they will be ...
0
votes
1answer
229 views

How to unban from fail2ban?

fail2ban banned my ip for SSH. In email I received that said I got banned via fail2ban after 5 attempts against SSH. Which is not even truth i wasn't even loging to SSH. I can still access webmin. I ...
2
votes
1answer
64 views

Use of backreferences in fail2ban filters possible?

From time to time, I see collections of suspect "File not found" errors in my Apache logs, basically using the pattern File does not exist: /var/www/file, referer: http://my.server.com/file In ...
0
votes
1answer
133 views

fail2ban iptable rule wont block

So I set up fail2ban on my Debian 7 server, still I've been getting hit a lot and I dont know why is not blocking properly. The regex works, it recognizes the attempts but it seems the iptables rules ...
1
vote
0answers
135 views

nginx with fail2ban and mod_security

I forgot to update my fail2ban config for nginx. I just moved to nginx from apache. Today, I got a lot of cals from a single IP. IP tried to access login pages with post and get methods IP tried to ...
1
vote
1answer
41 views

Fail2ban still adding to log after uninstall

I am running a CentOS6 VM and I have been playing with Fail2ban, upon removing the service from my server I can see that it appears to be still posting logs to the /var/log/maillog Here is a link a ...
0
votes
1answer
620 views

Why fail2ban 0.8 doesn't start properly on Debain 7 Wheezy x64?

Why fail2ban 0.8 doesn't start properly on Debain 7 Wheezy x64? Hi, I'm trying to configure fail2ban to work with APF. But first, it would be great if fail2ban can start. root@akdom:/var/log# ...
2
votes
4answers
329 views

Protect ssh server

I've got a debian-machine running several services, like apache with http and https, jabber and an openssh server for administration. The ssh-server is not running on port 22. It's on something like ...
0
votes
1answer
143 views

fail2ban block retry count always changes

As title mentions clearly, fail2ban block retry count always changes. I set all retry counts to 3; but sometimes it blocks me after 6 or 7 retries. How can set its behavior a constant value? I added ...
0
votes
1answer
68 views

fail2ban doesnt permanently block

Fail2ban doesn't seem to block permanently. I have bantime =-1 but if i look a bit later on my iptables its just not there anymore all ill see is Chain fail2ban-ssh (1 references) target prot ...
0
votes
0answers
983 views

Fail2Ban + BIND to ban “DNS format error from X.X.X.X resolving something.com/MX for client Y.Y.Y.Y: invalid response” or not to ban?

Recently, the increased load on the DNS, to log a lot of records like this: 14-Aug-2013 17:14:22.834 resolver: notice: DNS format error from 204.13.160.143#53 resolving palactive.com/MX for ...
1
vote
0answers
208 views

How to Exclude Log Using Fail2Ban logpath with Wildcard Settings

I'm using wildcard in the logpath value as shown below: [http-get-dos] enabled = true filter = http-get-dos logpath = /var/log/ispconfig/httpd/*/access.log maxretry = 250 findtime = 300 #ban for 10 ...
0
votes
1answer
505 views

How to block Bad robots, spiders, crawlers and harvesters

I'm sick and tired of this bad robots, spiders, crawlers and harvesters. I have already configured my server to block IP connected for 5 minutes and with maxretry of 250 using fail2ban. But still some ...
5
votes
3answers
2k views

Why is iptables not blocking an ip address?

I have configured fail2ban to monitor a certain pattern of malicious traffic I'm getting and ban IP addresses associated. Everything seems to be working great -- the regex is matching the pattern ...
2
votes
3answers
3k views

fail2ban iptables having port 22 and fails to block ssh on custom port

This question is almost same problem like mine but accepted answer doesn't solve my issues In Fail2Ban, How to Change the SSH port number? SSH on port 22 everything works great. After 5 attempts ...
0
votes
0answers
352 views

fail2ban is failing to ban apache IP pattern

I just noticed that fail2ban reports it 'banned' an IP address doing the following: 183.60.48.25 - - [03/Jul/2013:10:14:26 -0700] "GET http://www.baidu.com/ HTTP/1.1" 200 5112 183.60.48.25 - - ...
0
votes
1answer
1k views

Fail2Ban can't insert iptables rule

It seems my fail2ban can't ban a host: 2013-06-22 18:18:24,546 fail2ban.actions.action: ERROR iptables -n -L INPUT | grep -q fail2ban-apache-noscript returned 100 2013-06-22 18:18:24,546 ...
1
vote
1answer
476 views

How to add a jail for specific IPs in fail2ban?

I would like to add a specific list of IPs for which I would like to get an email from Fail2ban after they make a couple of "GET" requests. The pattern to look for in apache's access logs is ^1.2.3.4 ...
0
votes
1answer
735 views

How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?

Fail2Ban on Ubuntu 10.04 Configuration files /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1 bantime = 10 # made for test purposes maxretry = 3 backend = polling destemail = ...
-3
votes
2answers
1k views

Logrotate error for fail2ban

I get the following error when running a cron job, and I'm not too sure how to go about fixing. This is on Ubuntu 12.04 LTS. test -x /usr/sbin/anacron || ( cd / && run-parts --report ...
0
votes
0answers
299 views

How to protect Nginx from HULK DoS tool

There is a tool called HULK (Http Unbearable Load King). It's a web server denial of service tool. It is designed to generate volumes of unique and obfuscated traffic at a webserver, bypassing caching ...
1
vote
2answers
205 views

Strange java user agent in access.log

I recently noticed a huge load on my main production server, after some log parsing i stumbled upon a large number of those user agents originate from about 20 different IPs: 173.244.182.194 - - ...
1
vote
2answers
391 views

Is there any reason to use fail2ban with SSH password logins disabled?

I am setting up an Ubuntu server hosted by Linode. I am stepping through their security guide and they recommend installing fail2ban after disabling password based SSH logins. I don't see the point ...
0
votes
1answer
612 views

Anti-DDos Apache2 Fail2ban regex rule [duplicate]

I have fail2ban up and running, but my Failregex doesnt match anything, something is wrong. Request which i like to ban look like this: 186.6.65.199 - - [06/May/2013:18:46:21 +0400] "GET / HTTP/1.1" ...
1
vote
2answers
112 views

Run fail2ban without banning

It is possible to run fail2ban in some kind of "simulation mode" so it does not ban but log somewhere who it would have ban? Running fail2ban on Ubuntu 12.04.
0
votes
0answers
199 views

Fail2ban fails to parse logs, no error, no warning, no banning on CentOS

Using latest build (0.8.8) on CentOS i've setup fail2ban to filter Kerio spam/harvest attacks. Here's my kerio.conf [INCLUDES] before = common.conf [Definition] failregex = .*SMTP connection from ...
2
votes
2answers
108 views

Can Fail2Ban recognise failed logins to locked accounts?

I have locked the root account on my server with passwd -l root and so an attempted login results in the following in /var/log/auth.log: User root not allowed because account is locked Fail2Ban ...
4
votes
1answer
2k views

Installing from EPEL on Amazon EC2

I am trying to install fail2ban on our Amazon EC2 Linux AMI (CentOS). I know that fail2ban is in the EPEL so I have done the following: wget ...
1
vote
1answer
232 views

Does fail2ban monitor rotated log files?

Does fail2ban continue to monitor rotated log files? For example, I have a rule monitoring /var/log/fail2ban.log which is automatically rotated by the system every week (7 days). I want to have a ...
3
votes
1answer
1k views

fail2ban cannot ban ip on all ports if it's already banned for specific port

I'm using a custom filter in fail2ban to search through it's own log and ban an ip after 5 bans from any of the regular filters. I'm using iptables-allports as action for this. All other filters are ...
1
vote
0answers
110 views

Fail2ban on Ubuntu 11.10 does not ban custom filter/jail

An application I'm running logs incorrect logins such as this: Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 ...
4
votes
1answer
3k views

How to set up fail2ban to read multi log in a jail?

How can I configure multiple logpaths for the same rule? I'm trying to write a syntax like this: [apache-w00tw00t] enabled = true filter = apache-w00tw00t action = iptables-allports logpath = ...
1
vote
2answers
551 views

Setting up fail2ban to ignore connections behind a dynamic IP

Using fail2ban to secure an Ubuntu 12.04 x64 Server on DigitalOcean, while editing /etc/fail2ban/jail.local there's this part: [DEFAULT] # "ignoreip" can be an IP address, a CIDR mask or a DNS host ...
-1
votes
1answer
567 views

Fail2ban memory usage

Since my server is under a sustain DNS amplification attack (DDOS), I configured fail2ban and initially my outgoing traffic dropped markedly. Anyway, after a few hours (mostly +10), fail2ban uses ...
3
votes
2answers
1k views

fail2ban custom action to permanent ban IPs from China

When a IP address gets banned how can I check if the banned IP address is from China. If yes, then add it to the permanent ban list. I have found this nice guide which write the banned IP to file. ...
4
votes
1answer
1k views

measures to take against a dns amplification attack

I recently discovered that my server was being used as part of a DNS DDOS. Basically, my BIND setup allowed recursion, and it was used to attack a certain IP address using IP spoofing. I took the ...
2
votes
3answers
2k views

Have fail2ban send notification to banned party

I have fail2ban configured on some CentOS 5 and 6 servers, and it sends me an email with a whois of the IP whenever an IP is banned. Is it possible to configure fail2ban to also send a notification ...
1
vote
1answer
282 views

Do we need PSAD if we already have Fail2Ban?

I already have installed Fail2Ban on my server. I planned to install PSAD on it. Are they equal? Isn't it a good idea to keep them both?
2
votes
2answers
244 views

fail2ban-apache not blocking IP

I'm trying to configure fail2ban, I attempted to log into my web server numerous times to trigger the rule and looking at my iptables it seems to have worked: Chain fail2ban-apache (1 references) ...
5
votes
1answer
3k views

Custom fail2ban Filter for phpMyadmin bruteforce attempts

In my quest to block excessive failed phpMyAdmin login attempts with fail2ban, I've created a script that logs said failed attempts to a file: /var/log/phpmyadmin_auth.log Custom log The format of ...
1
vote
3answers
2k views

Setting up fail2ban to ban failed phpMyAdmin login attempts

We've been using fail2ban to block failed ssh attempts. I would like to setup the same thing for phpMyAdmin as well. As phpMyAdmin doesn't log authentication attempts to a file (that I know of), I'm ...