Questions tagged [fail2ban]

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

Filter by
Sorted by
Tagged with
0 votes
2 answers
2k views

fail2ban PostgreSQL Filter not working

I use this filter for postgresql: [Definition] failregex = ^<HOST>.+FATAL: password authentication failed for user.+$ ^<HOST>.+FATAL: no pg_hba.conf entry for host .+$ ...
1 vote
1 answer
659 views

fail2ban not creating jails in CentOS

I'm trying to create a jail in Fail2Ban to protect a Asterisk PBX. I already did as suggested and made a copy of jail.conf named jail.local. In jail.local, I set up a asterisk jail as follows: [...
0 votes
0 answers
325 views

Fail2Ban blocking everything on every port, no access

I copied the jail.conf to jail.local and used the Default jail to block IPs on every port with the default bantime etc. I also changed "enabled" to true. After restarting the service, I was ...
2 votes
1 answer
943 views

How to send a systemd ssh error so that it's picked by fail2ban

I have a setup which uses ansible and vagrant to test a custom role which installs and configures fail2ban. I have written myself a simple test playbook which uses the fail2ban role and applies the ...
0 votes
1 answer
2k views

Fail2Ban - Posfix-SASL not working

i have a problem that my fail2ban will not ban sasl authentications against my postfix. This is an example log entry from /var/log/syslog: Jul 31 13:42:21 v50428 postfix/smtps/smtpd[635398]: warning: ...
0 votes
1 answer
2k views

Change the order that an IPTABLE CHAIN is read (Using Fail2Ban)

I have some experience using iptables and fail2ban. Both are working as they should, but I would like to optimize the way packets are "DROPed" when IP & port probing occur. Fail2Ban is doing a ...
3 votes
2 answers
2k views

nginx as proxy for WebSocket: inspect and block certain requests

I ran NodeJS as a kind of Webapplication Server serving an AngularJS frontend. They communicate solely over WebSockets, using the SailsJS implementation of Socket.IO. Between frontend (client) and the ...
0 votes
1 answer
432 views

Blocking tor traffic with postfix or fail2ban on mailserver

I am running an Ubuntu 20.04 Lemp server, with postfix/dovecot. I have fail2ban set up so that if 2 unsuccessful loging attempts to my email are made by the same ip address, fail2ban bans the ip's ...
0 votes
1 answer
2k views

How can I get nginx-botsearch of Fail2Ban to match a string but also not match that same string if it has additional trailing characters?

System is Ubuntu 16.04. Using fail2ban from the package manager (which is currently 0.9.3-1). Have enabled nginx-botsearch in jail.local. Here is my /etc/fail2ban/filter.d/nginx-botsearch.local (note ...
2 votes
2 answers
3k views

Fail2ban not respecting email settings

In Fail2ban I have set up my email settings as: # Destination email address used solely for the interpolations in # jail.{conf,local} configuration files. destemail = [email protected] # # Name of the ...
-3 votes
1 answer
438 views

I need a script to ptint output from fail2ban

I installed Fail2ban and it's working fine. I'm NOT a Linux guru, sorry. I can just about find my way around. I need a script that will print all banned IP addresses and most important the DATE AND ...
2 votes
2 answers
963 views

Fail2ban socket permissions reset on reboot

I have some specific group/permissions set for my fail2ban.sock file to make Zabbix able to monitor Fail2ban as described here https://github.com/hermanekt/zabbix-fail2ban-discovery- I added the ...
0 votes
1 answer
300 views

Fail2ban : regex used in failregex does not work (square brackets ] issue ?!)

With fail2ban, I want to ban IPs based to the content of apache_access.log file. This is an example of line I want match with regex rules : 197.221.254.56 - - [13/Jun/2022:22:59:59 +0200] "GET / ...
0 votes
1 answer
3k views

How to setup fail2ban with ufw to block IPv6?

Since fail2ban Version 0.10 IPv6 is supported. I used fail2ban in conjunction with ufw. I found that only IPv4 addresses are blocked. This is unfavorable. Failed to execute ban jail 'nginx-noscript' ...
20 votes
13 answers
38k views

Stop fail2ban stop/start notifications

If the server is restarted, or even if fail2ban is stopped/start it sends a notification. [asterisk-iptables] enabled = true filter = asterisk action = iptables-allports[name=ASTERISK, protocol=...
3 votes
2 answers
1k views

My custom fail2ban jail fails to load even though fail2ban-regex suggests that it should work?

I've written a custom jail and filter in fail2ban for logging into my service. The log file is located in /var/log/motion/motion.log and a failed login generates a line like this: [0:ml1] [ALR] [STR] [...
0 votes
1 answer
2k views

Fail2ban ipset create fail2ban-sshd hash: ip timeout -l

I have over 2.5 million ssh attempts and fail2ban and only a few thousand ip's blocked. The find time was set to 600, max retries 4, and bantime -1. The server is physically present. I changed the ...
2 votes
1 answer
2k views

How to restrict fail2ban log file size?

Sometimes, fail2ban create huge log file in my Centos 7 server. 2.9G fail2ban.log 2.7G fail2ban.log-20191102 17G fail2ban.log-20191109 Then,I have questions as below: 1.If I delete ...
0 votes
1 answer
530 views

Editing fail2ban apache-noscript config to add "AH10244: invalid URI path"

I have the following (default) /etc/fail2ban/filter.d/apache-noscript.conf configuration file: [Definition] script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl|\bcgi-bin/) prefregex = ^%(...
1 vote
2 answers
3k views

Fail2ban doesn't find log file when launched from SYSTEMCTL but does when launched from CLI

The problem Fail2ban can't find the log file used by a jail when launched with systemctl start fail2ban.service but works perfeclty when launched manually with fail2ban-client start. The stacktrace $ ...
3 votes
3 answers
1k views

Run fail2ban without banning

It is possible to run fail2ban in some kind of "simulation mode" so it does not ban but log somewhere who it would have ban? Running fail2ban on Ubuntu 12.04.
0 votes
1 answer
296 views

fail2ban iptables returned 200, iptables 0 references

I installed fail2ban but on start I got multiple error messages: iptables -n -L gives me 0 references for each jail. (should be 1?) Chain INPUT (policy ACCEPT) target prot opt source ...
1 vote
1 answer
7k views

Unable to reinstall fail2ban after completly removing it from Centos 7

After completely removing Fail2ban from Centos 7, I decided to reinstall it. So I run the installation(yum), and everything seems ok, no errors, But the it seems like the installation does not create ...
0 votes
1 answer
1k views

fail2ban appears to be working but server still receives connection attempts

fail2ban mistery! Everything seems to be working and well configured but server still receives connection attempts. [moso@matrix ~]$ sudo systemctl status fail2ban ● fail2ban.service - Fail2Ban ...
9 votes
3 answers
7k views

fail2ban blocks IP in ignoreip list

I'm using fail2ban and it continues to block an IP even after I have whitelisted that IP. In /etc/fail2ban/jail.conf there is a line like the following one: ignoreip = 53.45.114.103 However fail2ban ...
5 votes
3 answers
12k views

How to ban Syn Flood Attacks using Fail2Ban?

In my log, I am frequently seeing dropped ips like this: > Oct 30 17:32:24 IPTables Dropped: IN=eth0 OUT= > MAC=04:01:2b:bd:b0:01:4c:96:14:ff:df:f0:08:00 SRC=62.210.94.116 > DST=128.199.xxx....
0 votes
1 answer
287 views

fail2ban not banning but matches logs

I try to create a brute force protection with fail2ban. With the fail2ban test, it matches the logs I wanna match but with my test brute forcing the site with 7+ failed logins, it does not ban my ip ...
0 votes
1 answer
65 views

sendmail and pacemaker require different /etc/hosts

Trying to make run sendmail (required by fail2ban, or it takes forever to start-stop-restart it) and pacemaker on one machine. Sendmail wants machine's hostname resolved as 127.0.0.1, pacemaker - as ...
0 votes
1 answer
1k views

fail2ban: apache-badbots is not working

I have a working fail2ban configuration which not only blocks IPs but also announces them to the AbuseIPDB. This is working fine for sshd and postfix-sasl, but not for apache-badbots (and resultign ...
0 votes
2 answers
666 views

fail2ban not banning "matched" IPs from vsftp log

Using fail2ban to secure the vsftp login: jail.local [vsftpd] enabled = true bantime = 600 findtime = 5000 maxretry = 1 port = ftp,ftp-data action = iptables-multiport logpath = /var/log/vsftpd/...
1 vote
2 answers
2k views

block nginx connection after multiple 404 s on same tcp connection

I'd like to protect two servers against attackers who blindly probe for urls. my idea is to block requests after a certain amount of 404 status codes. I could do this with fail2ban. However one of the ...
0 votes
1 answer
152 views

Is it necessary to ban malicious IP regardless of default firewall setting being deny/reject?

I'm on Linux and using fail2ban as the ban system. So far, it has collected and banned about 150K of malicious IPs, and I'm concerned and wondering if this will gobble a fair amount of resources. As I ...
1 vote
2 answers
2k views

can fail2ban add deny rules to nginx instead of using iptables

I'm having one server, that is behind a reverse proxy, that I don't control. I'd like to use fail2ban to block nginx traffic under certain conditions. normally fail2ban useses iptables to block ...
1 vote
1 answer
3k views

Fail2ban bantime.increment not working

I wanted to increase the bantime of repeat offenders getting caught by fail2ban. I added the following lines at the top of /etc/fail2ban/jail.local and fail2ban.local [DEFAULTS] bantime.increment = ...
0 votes
1 answer
556 views

Backtesting Historical Logs in fail2ban

Setup I'm running apache on an ubuntu server. I've created a fail2ban rule which bans an ip when they request too many pages too fast. # Fail2ban Rule failregex = ^.*?(:80|:443) <HOST> - .* &...
1 vote
1 answer
1k views

Enabling PHPMYADMIN Logging & Fail2ban Default Filter

I am on Debian 10.5 LAMP with ISPConfig, running PHPMYADMIN 4.9.0.1. I installed phpmyadmin following this tutorial I can only guess that somehow ISPConfig may be interrupting something. In any case, ...
1 vote
1 answer
5k views

fail2ban error with ssh-ddos Unable to read the filter 'sshd-ddos'

I am trying to get fail2ban working with ssh. I have changed the ssh port to 900 and have the following in /etc/fail2ban/jail.local: [sshd] enabled = true port = 900 logpath = %(sshd_log)s This works ...
0 votes
1 answer
277 views

Bot detection by fail2ban

I want to know if it is possible to use in fail2ban some rule / script that detects the bots, not just by maxretry in a given amount in seconds, but through identifying some patterns for every IP: for ...
0 votes
1 answer
1k views

How to create failregex to block imap-logins fail2ban

Could someone help me with creating correct fail2ban filter. Bad ip addresses knocking port 993 /etc/fail2ban/filter.d/dovecot.conf doesn't catch such log I found something like this, but i get errors ...
0 votes
1 answer
4k views

fail2ban fails to add iptables to rules

I'm having issues with fail2ban is not adding the banned IP to iptables. this is the error; 2022-01-29 15:13:48,499 fail2ban.actions [2608]: NOTICE [man] Restore Ban 212.192.246.26 2022-01-29 ...
-2 votes
1 answer
747 views

FAIL2BAN filters- who can give me filter to block this intrusion?

I see in my mediatemple server maillog endless intrusion. i need to block these ips. who can help with filter file to match these? Jan 21 07:51:44 mydomain postfix/smtpd[23505]: SSL_accept error from ...
0 votes
1 answer
1k views

Use value of <F-USER> from fail2ban regex

I am trying to send e-mail to me and user that someone tried to login to their ssh and failed - the IP got banned. But I don't understand how can I use the variable in the e-mail I am trying to send. ...
0 votes
1 answer
670 views

Failed to restart fail2ban.service: Unit firehol.service not found

When you come accorss this error after uninstalling Firehol. Check that you don't have this block: [Unit] # Starting fail2ban will automatically start firehol before it. # Stopping firehol will ...
1 vote
1 answer
385 views

Implement fail2ban to prevent brute force attack on a web site (using standard user authentication); work when the number of tries = maxretry+1

I am working on an course assignment to implement fail2ban to prevent brute force attack on a web site (using standard user authentication). I have set up my apache web server as well as fail2ban ...
4 votes
2 answers
6k views

[27759]: ERROR Failed to execute ban jail 'sshd' action in fail2ban log

On my Debian 8 server, I see lots of this error in fail2ban log. [27759]: ERROR Failed to execute ban jail 'sshd' action 'iptables-multiport' info 'ActionInfo({'ip': '1.1.2.2', 'fam ily': 'inet4',...
7 votes
1 answer
9k views

fail2ban- How to whitelist a big list of IP address to the jail.local file

My CDN provider gives me a big list of IP to whitelist, I need to add them to the line of ignoreip = in jail.local. The list of IP address provided is line by line with one line one IP address, but ...
0 votes
0 answers
569 views

Is it worth it to install and configure fail2ban for an Bind9 authoritative DNS server?

In our project infrastructure we have a nameserver, based on bind9. This nameserver is configured as primary and authoritative, so it is quite important. The question is, should I install and ...
1 vote
1 answer
702 views

Fail2ban regex working but not banning. DNS warning instead

I had the following problem (already solved) with fail2ban and misplaced it on stack overflow so I'm putting it here now. So, I've been reading issues for some days and don't seem to find a solution ...
1 vote
1 answer
1k views

fail2ban - Additional regex for sshd filter

I am currently trying to catch failed SSH login attempts with certificate based authentication (certificate correct but wrong password) using fail2ban version 0.11.2-2 (running on Debian 11). ...
14 votes
3 answers
19k views

Installing from EPEL on Amazon EC2

I am trying to install fail2ban on our Amazon EC2 Linux AMI (CentOS). I know that fail2ban is in the EPEL so I have done the following: wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-...

1 2
3
4 5
15