Questions tagged [fail2ban]
Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.
724
questions
0
votes
1
answer
2k
views
fail2ban does not work for ssh except on port 22
My fail2ban is not working for sshd except for the default port 22/tcp.
My old, working config in jail.local:
[sshd]
enabled = true
port = ssh
Tested fail2ban, did ban me after 3 failed attempts ...
- 103
0
votes
1
answer
510
views
Can fail2ban-client tell me if an ip from a CIDR range is in a jail? [duplicate]
If I have a CIDR like 13.54.63.128/26 can fail2ban-client tell me if there's an IP in this range that's currently banned?
Currently I'm doing:
CIDR="13.54.63.128/26"
nmap -sL -n $CIDR | awk '...
- 324
1
vote
0
answers
35
views
get mail from fail2ban only if aspecific ip(range) is blocked
is it possible to get only mails from fail2ban if a specific IP(range) is blocked?
I got it configured that I got mails if an IP blocked, which works fine
- 121
2
votes
1
answer
572
views
Fail2ban partial IP match possible?
My server (Ubuntu 18.04) is getting a lot of spam requests on Postfix. Fail2ban is working but the spammers keep changing the last part of IP and not getting banned. For example,
2021-10-09 09:40:01,...
- 260
0
votes
1
answer
553
views
Fail2ban regex not working
I would like to block any get request to /.git, /wp-login,/remote/login/, so i have created the following filter which also includes other requests.
badagents = 360Spider|ZmEu|Auto Spider 1.0|zgrab/...
- 101
1
vote
1
answer
722
views
fail2ban unban every ip when the server is shutting down, restoring every ban back again when newrly started
I have multiple jails with several thousands of banned IPs. The server was running for about a week non-stop, then when I was restarting it it took quite a long time ~2 mins to shutting down, and when ...
- 21
2
votes
1
answer
836
views
Fail2ban Filter Regexp
im use centos8 +fail2ban + haproxy
I have special jail "my-haproxy404" with this settings:
[my-haproxy404]
enabled = true
port = http,https
filter = my-haproxy404
logpath = /var/log/...
- 21
2
votes
2
answers
978
views
Fail2ban socket permissions reset on reboot
I have some specific group/permissions set for my fail2ban.sock file to make Zabbix able to monitor Fail2ban as described here https://github.com/hermanekt/zabbix-fail2ban-discovery-
I added the ...
- 43
2
votes
1
answer
1k
views
fail2ban detects the attacker IP but doesn't ban it, and is slow reading logs
From a few days I'm receiving attacks from some IP addresses to my nginx. I have decided to use fail2ban to ban it automatically, but I have noticed that is not working very well. I can see in logs ...
0
votes
1
answer
156
views
Why my port 27015 is scanned by several ISP across the world?
I configured my server to block all ports except 22,80 and 443 with UFW.
I then created a fail2ban rule to put in jail every IP that scan ports unsuccessfully more than 5 times and report it to ...
- 101
0
votes
1
answer
599
views
Fail2ban not blocking ssh attempts
I have set up fail2ban to block failed ssh attempts. I checked the rule with fail2ban-regex and and an extract from my logs, this works fine.
I also checked the logs for the "Ban" notice and ...
- 61
0
votes
1
answer
1k
views
Fail2Ban blocks ip despite both ignoreself and ignoreip being set in jail.local
solution: The IP range in ignoreip was set incorrectly using CIDR. It should have been 192.168.2.0/24 rather than 192.168.2.1/32.
original post:
Another user had a similar problem caused by ...
- 1
0
votes
1
answer
192
views
Fail2Ban banning addresses that SHOULD already be banned
I am running the default fail2ban ssh-auth rule to ban ips with 3 or more failed auth attempts in a window. However, I noticed a particular network being the source of a disproportionate amount of ...
- 101
1
vote
1
answer
477
views
Fail2ban filter for mongodb
Fail2Ban version: 0.10.2
I have tried a lot of filter config files for MongoDB remote authentication fail, none of them have been working, I have figured that the problem is with failregex and I am ...
- 13
1
vote
2
answers
3k
views
iptables block everything but http/https/ssh
I have this iptables configuration on my vps which is supposed to run Wordpress. What I want to do is block every incoming request except http on port 80, https on port 443 and ssh on port 22.
Chain ...
- 27
4
votes
2
answers
4k
views
fail2ban does not use DROP blocktype
Using Ubuntu 20.04 LTS, I have this in /etc/fail2ban/jail.local:
[DEFAULT]
bantime = 3600
banaction = iptables
blocktype = drop
[sshd]
enabled = true
protocol = tcp
port = ssh
filter = ...
- 809
0
votes
1
answer
534
views
How do I set up Fail2Ban on an Amazon Lightsail Debian instance, when it has its own firewall?
This is a very basic question, but all the answers I can find either relate to WordPress installs or Bitnami installs. I have a plain Debian instance running Nginx.
I would like to set up Fail2Ban. ...
- 135
1
vote
1
answer
1k
views
Create own filter for fail2ban fails
I'm playing around with fail2ban in kubernetes. For that I created a pod that creates fake log messages: 2021-08-04 18:33:13 Authentication failed 15.15.15.15 I created a custom filter, to test if ...
- 111
0
votes
0
answers
364
views
Fail2ban exited and didn't start back up
Today I faced a what seemed like a DDOS attack. My server provider warned me about excessive CPU usage (400% for over 6 hours) and I couldn't access any website, could not login via SSH either. Lish ...
- 260
1
vote
1
answer
707
views
Error trying to ban ip addresses from apache with fail2ban: Sorry but the jail 'apache' does not exist
I want to use fail2ban to block specific ip addresses with:
sudo fail2ban-client set apache banip 111.111.111.111
I get:
NOK: ('apache',)
Sorry but the jail 'apache' does not exist
I'm also confused ...
- 552
1
vote
1
answer
288
views
fail2ban initial setup - guidance
From my basic understanding of iptables I put together the below setup intended to run a Tor relay... here it is after 6 hours approx. Please note, I do not want to discuss any Tor operations, and so ...
- 499
0
votes
0
answers
448
views
Bind/Fail2ban how to reject requests from certain domain
Today I got my VPS stucked.
Centos 7, 4 cores, Bind 9.11.
From ssh I got
Message from syslogd@host at Jul 18 09:46:16 ... kernel:NMI watchdog:
BUG: soft lockup - CPU#0 stuck for 41s! [f2b/observer:...
1
vote
1
answer
653
views
fail2ban does not start jails on cenots 7
SOLVED - sshd conf file was in wrong directory and with wrong extension
i have fallowed this tutorial htf and everything went smoothly, fail2ban starts nicely, i disabled selinux just in case, but ...
- 13
0
votes
1
answer
1k
views
Fail2ban on CentOS 7 with Docker-powered Traefik ban OK without iptables rule addition
I set up a Traefik instance run by Docker engine in Swarm mode with a "classical" configuration (see below, for sake of brevity I only put relevant [to me] parts. Feel free to ask more ...
- 127
2
votes
2
answers
1k
views
fail2ban wont start/Python syntax error
I installed fail2ban on my Ubuntu 18.04 server. But when i try to start the service i get this error.
fail2ban.service: Start request repeated too quickly.
fail2ban.service: Failed with result 'exit-...
- 23
0
votes
1
answer
798
views
Fail2ban with Firewalld on RHEL 8 - Fail2ban seemingly blocks IPs, but they are not really blocked
I'm running fail2ban on RHEL 8 using firewalld. According to the fail2ban log (with DEBUG level) it blocks IP addresses without any error, but in fact there are no such rules in firewalld and nftables....
3
votes
2
answers
16k
views
How to set up fail2ban with UFW on Ubuntu 20.04?
I'm trying to block IP addresses with fail2ban and ufw with the following configuration and the default ufw.conf in /etc/fail2ban/action.d.
Jail config
[app-custom]
enabled = true
maxretry = 1
...
- 173
1
vote
1
answer
708
views
Fail2ban regex working but not banning. DNS warning instead
I had the following problem (already solved) with fail2ban and misplaced it on stack overflow so I'm putting it here now.
So, I've been reading issues for some days and don't seem to find a solution ...
- 31
0
votes
1
answer
835
views
Why are my failed login attempts adding a banned IP but not banning me?
I'm failing some login attempts on purpose in a repeated fashion so as to trigger the banning of my IP address.
The /var/log/fail2ban.log file shows:
2021-05-29 14:27:34,332 fail2ban.filterpyinotif [...
- 227
0
votes
1
answer
130
views
How to block mysql EXTRACTVALUE with fail2ban?
How to block these with fail2ban?
45.154.255.147 - - [25/May/2021:08:32:40 -0700] "GET /search.php?q=xgp%2F%2A%2A%2Fbangla%2F%2A%2A%2Fcom%27%20PROCEDURE%20ANALYSE%28EXTRACTVALUE%281915%2CCONCAT%...
- 67
1
vote
0
answers
598
views
Is fail2ban regex standard?
I have a log entry:
[22-May-2021 08:36:01 Europe/London] 10.0.0.2 - Failed admin login attempt for root at http://www.example.com:80
that I'm trying to be matched by a fail2ban configuration.
I test ...
- 227
2
votes
1
answer
689
views
fail2ban "expired bantime" after unban
I have this fail2ban jail targeting an apache log (currently with some small values so I can experiment):
enabled = true
maxretry = 3
bantime = 10
findtime = 5
action = 429-ban
I stress test it using ...
- 824
-1
votes
1
answer
159
views
Fail2Ban is not updating iptables rules
I have set up fail2ban to protect my ssh port using these rather old instructions: https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-14-04
I tested my set-up ...
- 121
1
vote
2
answers
182
views
fail2ban weird ban behaviour bans not IP properly
I'm try to ban all suspect 403 errors via fail2ban.
So I created this jail
# block 403 errors
[apache-403]
enabled = true
filter = apache-403
port = http,https
logpath = /var/log/apache2/...
- 33
1
vote
1
answer
1k
views
Fail2Ban with named and systemd on Debian 10
default in Debian 10 named is logging to systemd. Latest filter in fail2ban: https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/named-refused.conf
is working only with /var/log/named/...
- 11
0
votes
1
answer
462
views
I'm Under attacks even with mod_evasive mod_security and fail2ban [closed]
I have my centos fresh server with no problem, I have httpd, named but I get 150 failed logins per 10 minute. I also use Fail2Ban with maxretry 1 findtime 6h. and mod_evasive mod_security default ...
0
votes
2
answers
3k
views
Is fail2ban working without firewalld?
do i need firewalld for fail2ban to work?
Can fail2ban block IP's with iptables only?
I've installed iptables-service on a CentOS 8 vps. I use nftables v0.9.3 (Topsy) to restrict/grant access. ...
- 21
0
votes
1
answer
846
views
Fail2ban banning odd IP address that are not in logs (0.0.0.4, 0.0.0.5, etc)
Server: Nginx
Fail2ban version: v0.9.3
It seems like no matter what I try, I cannot get fail2ban to find the correct host from the log entry consistently.
/etc/fail2ban/filter/expanse-bot.conf:
[...
- 368
1
vote
1
answer
228
views
Harassed by ssh connection attempts, how to make fail2ban more strict?
I use the default fail2ban configuration for ssh connection attempts on my Debian server hosting my web and mail servers.
I already switched away from the default ssh port and things were quite for a ...
- 448
4
votes
1
answer
2k
views
fail2ban: whitelist IPv6 address
I need to whitelist an ipv6 address in fail2ban, however when I just add them to the ignoreip statement in my jail.conf they get blocked anyways.
This is what I have in /etc/fail2ban/jail.conf
[...
- 169
0
votes
1
answer
386
views
Postfix/Fail2ban, Send mail to admin on problems
I would like for Postfix if possible, or Fail2ban if possible (without banning) to send a notification email to root or an admin account with the logline when something wrongs happens when sending an ...
- 21
0
votes
0
answers
503
views
Fail2Ban: Are these IPs really blocked?
This is my jail.local
[DEFAULT]
ignoreip = 127.0.0.1/8 192.168.1.0/24
[nginx-custom]
enabled = true
logpath = /var/log/nginx/access.log
action = iptables-multiport[name=nginx-custom, port="...
- 111
0
votes
1
answer
183
views
Should I, and how should I defend against DOS SMTP attack
I was troubleshooting an outlook client trying to authenticate with the Mail server, and the client would time out ( it was an issue with a local outlook installation & machine firewall)
To ...
- 105
1
vote
1
answer
359
views
Fail2Ban: Why Fail2Ban is banning Cloudflare ips, but rules seem not match?
This is my /etc/fail2ban/filter.d/nginx-custom.conf
[Definition]
badagents = 360Spider|ZmEu|Auto Spider 1.0|zgrab/[0-9]*\.[0-9a-zA-Z]*|Wget\(.*\)|MauiBot.*|AspiegelBot.*|SemrushBot.*|PHP/.*
...
- 111
0
votes
1
answer
481
views
fail2ban not working with SSHD using busybox-syslogd
I am running fail2ban (0.9.6-2) on Debian 9 with busybox-syslogd logging to /var/log/auth.log
setup with the following line in /etc/rc.local to get logs written to file.
/sbin/syslogd -O /var/log/...
- 13
1
vote
1
answer
3k
views
Fail2ban how to configure custom fail regex filter
I am running fail2ban on Debian 9 and am trying to create a custom filter to ban an ip after 4 failed attempts. Can someone help to figure out what I need to put in filter.d and jail.conf in order ...
- 13
1
vote
1
answer
1k
views
Fail2ban - stop DOS attack from remote host - won't start
SOLUTION
##To stop DOS attack from remote host.
[http-get-dos]
enabled = true
port = http,https
filter = http-get-dos
logpath = /var/log/apache*/access.log
maxretry = 400
findtime = 400
bantime ...
- 59
3
votes
3
answers
4k
views
Is it safe to apply fail2ban on sshd "Received disconnect/Disconnected ... [preauth]" logs?
I'm seeing a lot of logs like these in /var/log/auth.log (Debian Buster):
Jan 2 17:10:17 mybox sshd[16304]: Received disconnect from 1.2.3.4 port 37792:11: Bye Bye [preauth]
Jan 2 17:10:17 mybox ...
- 133
0
votes
0
answers
72
views
Fail2Ban failregex after office hours
How can we run specific failregex after office hours, and ignore during office hours as some of the conditions may detect wrongfully.
e.g this could be from users:
failregex = ^\.\d+ \[WARNING\] ...
- 101
6
votes
1
answer
736
views
I can not seem to get a Regex for to Fail2Ban to work with Opensmtpd? Can I get a sanity check?
I have openSMPTD running a mail server. It seems I am getting brute forced attacked currently, although I doubt they will get in. That being said, I would like to alleviate the burden on my server ...
- 179