Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

0
votes
1answer
310 views

How to mitigate DDOS attacks on AWS?

I have web application (NodeJS) and I plan to deploy it to AWS. To minimize the cost it will run on single EC2 instance. I'm worried though about what will happen if someone decides to bless me with ...
0
votes
0answers
19 views

Cannot get fail2ban failregex to match log

This is the failregex ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s ...
0
votes
2answers
100 views

Fail2ban not banning after update to latest version

I was running fail2ban 0.8.11 which is the version installed on Ubuntu 14.04 with apt-get. I downloaded and installed the latest source, 0.93. When I start it up, I get two error messages. WARNING ...
1
vote
1answer
90 views

Is fail2ban not matching these lines just because of the port?

I would like fail2ban to engage against these lines and block the example IP address included: [Tue Dec 08 12:17:13.622175 2015] [:error] [pid 30390] [client 62.210.88.201:38139] script ...
-1
votes
1answer
86 views

Is fail2ban necessary? [closed]

I have disabled the root login, disabled the password authentication option, and blocked all ports except 22 and 80 for a linux virtual server I run. The only way to access the server is with a 4096 ...
1
vote
0answers
40 views

How do I set Host Groups on Fail2ban for Wordpress?

I'm trying to set up a custom filter for fail2ban on a wordpress site. I've been following this tutorial but when I try to test my custom filter, I get the error: server.failregex.RegexException: No ...
2
votes
1answer
56 views

fail2ban rules not coming into effect

I have installed the Apache web server on a stock installation of Ubuntu 14.04, and I am trying to use fail2ban to block requests that check for vulnerabilities. I have put the following in ...
1
vote
1answer
29 views

fail2ban BANTIME not working for SASL

My fail2ban bantime does not appear to be working. I still get repeated ban notifications from the same IP within 45 minutes of each other. My bantime is set to 24 hours. [sasl] enabled = true port ...
-1
votes
1answer
71 views

Can I use the following Fail2ban jail with my wordpress on nginx server?

[nginx-noscript] enabled = true port = http,https filter = nginx-noscript logpath = /var/log/nginx/access.log maxretry = 6 It is advised to not enable [nginx-noscript] jail, if server is ...
1
vote
1answer
48 views

fail2ban for apache access log

I have tried all the approaches I know of to get the host from the apache access log but none have worked my basic testing approach is as follows: fail2ban-regex '87.97.244.57 - - ...
0
votes
0answers
52 views

Fail2Ban emails not showing extracts from Apache logfiles

I have recently set up Debian Jessie on a server for the first time. 'Obviously' fail2ban was set up very early in the process. It is banning IP addresses and sending me emails ok, but the ...
1
vote
0answers
10 views

Anomalous iptables entry with fail2ban (is it misconfigured to block outward traffic?)

Overall we are very satisfied with fail2ban as it has accumulated several dozen neverdowell IP addresses in our iptables rules. However I notice the following rule has also appeared: Chain ...
0
votes
1answer
249 views

Fail2Ban plug-in is enabled in Munin but the graph images are broken. How to fix?

I recently installed Fail2Ban on an Ubuntu 12.04.5 server and it’s working great. Now I want to setup Munin so it can monitor it and generate graphs/reports. I found that Munin has a built-in Fail2Ban ...
2
votes
1answer
421 views

How can I upgrade Fail2Ban in Ubuntu 12.04.5 LTS to get the “recidive” filter installed?

Basic question. How can I install an upgraded version of Fail2Ban on my Ubuntu 12.04.5 LTS (Precise Pangolin) so I can have a recidive filter set. Ubuntu 12.04.5 LTS installs Fail2Ban 0.8.6 and I ...
0
votes
1answer
116 views

Determining e-mail server blacklisting from log files

I have my self-hosted e-mail server. There is no current problem of being blacklisted but I want to be proactive about it and I want to start with the log files. There have been some entries in my ...
1
vote
1answer
78 views

What are the differences between Fail2Ban and BFD (Brute Force Detection)

I have used both Fail2Ban and BFD, typically I go with Fail2Ban on servers running IPTables, and BFD when servers are running APF. Are there any major differences between these 2 services? What are ...
3
votes
2answers
571 views

fail2ban.action ERROR iptables -w -N f2b-<jail-name>

I've been using fail2ban for a while without any issues. The other day, I decided to stop fail2ban to remove one rule from my default iptables. When I started fail2ban, it started ok (according to ...
0
votes
1answer
148 views

Change the order that an IPTABLE CHAIN is read (Using Fail2Ban)

I have some experience using iptables and fail2ban. Both are working as they should, but I would like to optimize the way packets are "DROPed" when IP & port probing occur. Fail2Ban is doing a ...
0
votes
1answer
137 views

Fail2ban: regex test succeed but fail2ban does not ban any IP

I can't ban any ip, thought when I test my regex, it has +2000matches: > fail2ban-regex '/var/log/nginx/access.log' '/etc/fail2ban/filter.d/bad-request.conf' Date template hits: |- [# of hits] ...
0
votes
0answers
11 views

How do I install fail2ban on CentOs 6.7? “Package will be installed… Killed” [duplicate]

I'm getting an error when I try to install it. [root@showcarpic ~]# rm -f /var/lib/rpm/__db* [root@showcarpic ~]# yum clean all Loaded plugins: fastestmirror Cleaning repos: base epel extras newrelic ...
2
votes
1answer
216 views

fail2ban regex filter doesnt work with nginx log files

I have been banging my head all day trying to match my regex filter to my access.log with no luck. I have installed fail2ban on a gentoo server and its running fine (i manually baned my own IP and it ...
1
vote
1answer
98 views

SELinux preventing Fail2Ban from emailing notification via msmtp

I have msmtp as a null client connecting to my AWS SES account for SMTP, delivering alerts such as cron, monit and soon hopefully Fail2Ban to my email addresses. However, Fail2Ban isn't playing ball, ...
0
votes
0answers
167 views

Fail2Ban Cannot Read NginX Log Files - SELinux - ERROR No file(s) found for glob

I've been having issues with this on and off and I've exhausted my abilities on this. It's a CentOS7 system with SElinux enabled. Fail2Ban works for most jails just fine, very happy with it. My ...
1
vote
0answers
107 views

Fail2Ban regex in sshd.conf not catching failed root logins in /var/log/auth.log

I used Fail2Ban on my Ubuntu server (14.04 LTS), and it mostly works well. I recently noticed the default regex in /etc/fail2ban/filter.d/sshd.conf does not match some failed sshd login attempts. ...
0
votes
1answer
64 views

Fail2ban fail to start with several error messages

I've installed fail2ban for my CentOS 6, but when it starts, I get the error message Failed to start server : Starting fail2ban: WARNING 'ignoreregex' not defined in 'Definition'. Using default one: ...
1
vote
1answer
35 views

fail2ban blocks ip twice for some reason

I have a file of blacklisted IPs that get loaded through fail2ban into iptables when fail2ban starts up. Assuming the initial list looks like this at startup: Chain fail2ban-ip-blacklist (1 ...
0
votes
1answer
433 views

fail2ban multiple logpath directive

I've created my own custom filter, action etc for fail2ban. Just have a question about the logpath. logpath = /path/to/my/file1.log /path/to/my/file2.log ...
0
votes
1answer
85 views

CentOS 6 fail2ban fails to ban http dos requests

Fail2ban fails to ban clients that make an excessive amount of requests over HTTP. SSH bans do work fine To test this I have made several tests using ab and curl from other servers. I even made sure ...
1
vote
2answers
152 views

High inbound and outbound network traffic

Over the last day or so, one of instances has had a large amount of bandwidth consumed. This means that we have nearly exceeded our allowance (roughly the same amount inbound and outbound). Looking ...
0
votes
1answer
59 views

How to ban a ip with fail2ban using fail2ban-client and actionban

I am on fail2ban 0.8.3 and I would like to ban an ip address after reloading fail2ban. I tried: fail2ban-client get myjail actionban ip after that I get an empty line in bash and fail2ban status ...
1
vote
1answer
377 views

Fail2Ban Not Banning on CentOS 7 with SELinux

On a LEMP stack with WordPress and the WP fail2ban plugin, WordPress authentication issues get logged to /var/log/messages perfectly fine. $ sudo fail2ban-client version 0.9.2 In the last couple ...
2
votes
1answer
369 views

How to change mail “from” name for Fail2Ban email notifications?

I have Fail2Ban sending me emails from various servers but I can't tell at a glance which server because the email "from" name is always just "Fail2Ban". I've managed to set the "from" address ...
1
vote
1answer
145 views

fail2ban not mailing on Arch

I have 3 servers, 2 Debian and 1 Arch. As usual the Arch makes me work hard for the simple things. This time it's fail2ban. My installation of fail2ban is default, its version 0.9.3-3. To test if my ...
0
votes
1answer
107 views

why is are there dns host names in my iptables entries? (fail2ban)

I recently installed fail2ban which has begun blocking bad ssh attempts. I also set up an additional filter to permanently ban repeat offenders. I notice now that there are some entries in my ...
0
votes
2answers
478 views

ERROR Found no accessible config files for 'fail2ban' under /etc/fail2ban

So my fail2ban wasn't working and in attempts to make it work the config files got messy. Decided to start from scratch. I ran these as sudo apt-get remove fail2ban apt-get purge fail2ban rm -r ...
0
votes
1answer
131 views

fail2ban couriertcpd: LOGIN FAILED not banning

My fail2ban is not banning as I expect. An example of my log entries are :- Jul 26 07:11:29 mail couriertcpd: LOGIN FAILED, user=sally, ip=[::ffff:54.191.110.169] Jul 26 07:13:22 mail couriertcpd: ...
-1
votes
1answer
37 views

IPTABLES not working, fail2ban still notifying me of instrusions from those ips

I added 200 hundred iptable rules like these: iptables -A INPUT -s 108.62.150.0/24 -j DROP iptables -A INPUT -s 109.108.64.0/19 -j DROP iptables -A INPUT -s 109.110.32.0/19 -j DROP to block russian ...
0
votes
1answer
387 views

fail2ban config failregex for Tomcat 8 [closed]

The current fail2ban version 0.9.1 does not have a pre-configured filter for Tomcat. In case anyone needs it, here is a regex that works for me. Note that my application is not expected to have any ...
1
vote
0answers
37 views

Nginx: Logging 403's from proxies

So our server setup goes like this: www <-> nginx <-> backend services The internal services require authorisation, which often fails with a 403 if a user's token is incorrect and so ...
0
votes
0answers
309 views

Trouble figuring out a fail2ban log error message: “iptables -n -L INPUT | grep -q 'fail2ban-SSH[ \t]' returned 100”

Here is my jail.local rule for ssh: [ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] logpath = /var/log/messages maxretry = 5 Here is what my ...
0
votes
1answer
275 views

fail2ban wont ban ssh from local hosts

I'm trying to configure fail2ban to block ssh from a local hosts. Fail2ban is install on CentOS 7 with firewall (Linux 3.10.0-229.4.2.el7.x86_64 x86_64 ). I have copied the jail.conf to jail.local i ...
0
votes
0answers
65 views

Fail2ban not unbanning ip from jail

I've tried finding a way to unban an IP from fail2ban, but no matter what I do it seems to stay banned. I recently ran fail2ban-client get ssh actionunban myip and I do not get an error message, but ...
0
votes
0answers
43 views

fail2ban stops logging after some time (3-4 days)

I've noticed that whenever I want to see fail2ban logs after 3 or 4 days of being working, it compresses the logs to .gz which Im fine with that: -rw-r--r--. 1 root root 90034 May 1 12:49 ...
-2
votes
1answer
64 views

Default rules in fail2ban for apache

What does default apache (apache-auth, apache-overflows, apache-noscript) fail2ban jails do? I looked into docs, but there is nothing about it. Thanks for your help!
1
vote
0answers
86 views

Selinux: Shorewall will not respond to fail2ban

I am using fail2ban with shorewall and my Fedora 21 server & cloud. All flooded with the following error message: SELinux is preventing shorewall from write access on the file ...
0
votes
1answer
218 views

journalctl: Cannot filter ownCloud log lines, fail2ban will not ban

Using a general journalctl command, the log line of interest appears: [root@bee server]# journalctl -n -- Logs begin at Mon 2015-01-26 19:44:33 EET, end at Wed 2015-06-10 21:41:12 EEST. -- ... Jun 10 ...
-2
votes
1answer
117 views

Apache server crashes due to bandwidth spike issue [closed]

The problem I am facing is that my Website (hosted on a dedicated VPS) was working fine for last 6 months. However from last two days, it gets huge spikes of DATA coming in and this causes server to ...
3
votes
1answer
414 views

Fail2ban redirect

I've just finished setting up fail2ban on my Centos reverse proxy server. I was able to get it to block all requests if a certain criteria was met (pretty straight forward). However, I'd now like ...
0
votes
1answer
66 views

How to prevent password bruteforce in web application? [closed]

I have php web application (nginx+php-fpm). And someone try to bruteforce password. He have a lot of IPs. Also these bruteforce works like DDOS because each time web application starts and try to ...
0
votes
1answer
98 views

Make Fail2ban parse latest logs generated monthly.

I have a log file generated monthly (e.g messageApril2015.log,messageMay2015.log). Can anyone tell me how to make fail2ban parse the latest log? I have read somewhere about adding %F%Y but it didn't ...