Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

1
vote
3answers
1k views

fail2ban rule results in “iptables returned 200” error message

I just tried to add a new fail2ban rule that is supposed to scan Apache2 error logs for suspicious file access attempts (People who try to access three common login urls that do not exist usually ...
3
votes
1answer
4k views

fail2ban for windows 2008 RDP [duplicate]

I'm looking for a solution to make remote desktop more secure. I'm looking for a fail2ban like for windows and specially for RDP which will block IP in firewall after N failed retries Any help?
0
votes
3answers
889 views

fail2ban error about python?

I have just installed fail2ban on my debian7 machine but whenever i start it i get a lot of error which seems to be about python? [....] Restarting authentication failure monitor: fail2banTraceback ...
0
votes
1answer
743 views

Use fail2ban for Samba

I'm looking for a way to use fail2ban to control/block samba logins on Ubuntu 12.04.3 LTS. I already set up an jail.local. The samba part currently looks like this: [samba] enabled = true port = ...
0
votes
1answer
507 views

Point fail2ban to new log, without losing current bans?

I have logs in /var/log/syslog/YYYY-MM-DD/file.log files. New directories are created automatically by rsyslog, and logs are automatically put to new locations. Every day, I archive previous day of ...
0
votes
1answer
379 views

Fail2ban restarts every day

In my server I can see that the fail2ban restarts every day. While checking the internet I can see that the logrotate causes this. I have disabled the logrotate of fail2ban by removing the fail2ban ...
0
votes
1answer
141 views

How to configure fail2ban so it bans login attempts based on the structure of the attempted password or username

I want to set up two filters for fail2ban: If the user tries to login with a password that is less than 10 characters ban them. And if the user tries to login with a password that is more than 10 ...
1
vote
1answer
178 views

fail2ban jail not working properly

I'm trying to block non-available script requests to nginx with fail2ban. # Noscript filter /etc/fail2ban/filter.d/nginx-noscript.conf: # # Block IPs trying to execute scripts such as .php, .pl, ...
1
vote
1answer
644 views

fail2ban ignoreip DNS host example?

I would like to add ".googlebot.com" to the ignore iplist for fail2ban since the ignoreip explanation mentions DNS host as an accepted input. Is this a proper format? # "ignoreip" can be an IP ...
0
votes
0answers
399 views

Blocking X-forwarded-For IP in fail2ban?

I am using a reverse proxy in front of my web-server. In the web server I installed fail2ban and want to use it to monitor logs and block bad ip. I am using nginx with the http realip module. But ...
3
votes
2answers
2k views

Fail2ban log filled with entries saying “fail2ban.filter : WARNING Determined IP using DNS Lookup:..”

My fail2ban log at /var/log/fail2ban.log is completely filled with entries saying: fail2ban.filter : WARNING Determined IP using DNS Lookup: [IP address] I think this may have begun after I changed ...
3
votes
1answer
161 views

Fail2ban settings after changing ssh port

I switched my ssh port to 22000 and I changed the port settings in /etc/fail2ban/jail.local to specify to ban on both 22 and 22000 but when I tried failing to login 6 times, my connection was cutoff ...
0
votes
1answer
123 views

fail2ban receiving events but not triggering event

I have setup fail2ban to monitor a service which I have exposed outside my router. The files are being logged properly, and the events are being picked up by fail2ban 2013-11-21 01:05:24,573 ...
0
votes
2answers
3k views

fail2ban apache-noscript not working

My debian server has come under attack recently and I've been poring over the logs to see what I can do to harden it. I've been running fail2ban for a while but I've noticed the apache-noscript jail ...
6
votes
2answers
196 views

How to *add* rules in local fail2ban filter definition?

I have installed fail2ban as packaged by Debian on a server under my control. Since I have some failregexes from before, I'm putting those into the local filter definition file so they will be ...
0
votes
1answer
352 views

How to unban from fail2ban?

fail2ban banned my ip for SSH. In email I received that said I got banned via fail2ban after 5 attempts against SSH. Which is not even truth i wasn't even loging to SSH. I can still access webmin. I ...
2
votes
1answer
129 views

Use of backreferences in fail2ban filters possible?

From time to time, I see collections of suspect "File not found" errors in my Apache logs, basically using the pattern File does not exist: /var/www/file, referer: http://my.server.com/file In ...
0
votes
1answer
196 views

fail2ban iptable rule wont block

So I set up fail2ban on my Debian 7 server, still I've been getting hit a lot and I dont know why is not blocking properly. The regex works, it recognizes the attempts but it seems the iptables rules ...
1
vote
0answers
171 views

nginx with fail2ban and mod_security

I forgot to update my fail2ban config for nginx. I just moved to nginx from apache. Today, I got a lot of cals from a single IP. IP tried to access login pages with post and get methods IP tried to ...
1
vote
1answer
48 views

Fail2ban still adding to log after uninstall

I am running a CentOS6 VM and I have been playing with Fail2ban, upon removing the service from my server I can see that it appears to be still posting logs to the /var/log/maillog Here is a link a ...
0
votes
1answer
1k views

Why fail2ban 0.8 doesn't start properly on Debain 7 Wheezy x64?

Why fail2ban 0.8 doesn't start properly on Debain 7 Wheezy x64? Hi, I'm trying to configure fail2ban to work with APF. But first, it would be great if fail2ban can start. root@akdom:/var/log# ...
3
votes
4answers
519 views

Protect ssh server

I've got a debian-machine running several services, like apache with http and https, jabber and an openssh server for administration. The ssh-server is not running on port 22. It's on something like ...
0
votes
1answer
236 views

fail2ban block retry count always changes

As title mentions clearly, fail2ban block retry count always changes. I set all retry counts to 3; but sometimes it blocks me after 6 or 7 retries. How can set its behavior a constant value? I added ...
0
votes
1answer
97 views

fail2ban doesnt permanently block

Fail2ban doesn't seem to block permanently. I have bantime =-1 but if i look a bit later on my iptables its just not there anymore all ill see is Chain fail2ban-ssh (1 references) target prot ...
0
votes
0answers
1k views

Fail2Ban + BIND to ban “DNS format error from X.X.X.X resolving something.com/MX for client Y.Y.Y.Y: invalid response” or not to ban?

Recently, the increased load on the DNS, to log a lot of records like this: 14-Aug-2013 17:14:22.834 resolver: notice: DNS format error from 204.13.160.143#53 resolving palactive.com/MX for ...
1
vote
0answers
299 views

How to Exclude Log Using Fail2Ban logpath with Wildcard Settings

I'm using wildcard in the logpath value as shown below: [http-get-dos] enabled = true filter = http-get-dos logpath = /var/log/ispconfig/httpd/*/access.log maxretry = 250 findtime = 300 #ban for 10 ...
0
votes
1answer
685 views

How to block Bad robots, spiders, crawlers and harvesters

I'm sick and tired of this bad robots, spiders, crawlers and harvesters. I have already configured my server to block IP connected for 5 minutes and with maxretry of 250 using fail2ban. But still some ...
5
votes
3answers
3k views

Why is iptables not blocking an ip address?

I have configured fail2ban to monitor a certain pattern of malicious traffic I'm getting and ban IP addresses associated. Everything seems to be working great -- the regex is matching the pattern ...
2
votes
3answers
5k views

fail2ban iptables having port 22 and fails to block ssh on custom port

This question is almost same problem like mine but accepted answer doesn't solve my issues In Fail2Ban, How to Change the SSH port number? SSH on port 22 everything works great. After 5 attempts ...
0
votes
0answers
402 views

fail2ban is failing to ban apache IP pattern

I just noticed that fail2ban reports it 'banned' an IP address doing the following: 183.60.48.25 - - [03/Jul/2013:10:14:26 -0700] "GET http://www.baidu.com/ HTTP/1.1" 200 5112 183.60.48.25 - - ...
0
votes
1answer
3k views

Fail2Ban can't insert iptables rule

It seems my fail2ban can't ban a host: 2013-06-22 18:18:24,546 fail2ban.actions.action: ERROR iptables -n -L INPUT | grep -q fail2ban-apache-noscript returned 100 2013-06-22 18:18:24,546 ...
1
vote
1answer
1k views

How to add a jail for specific IPs in fail2ban?

I would like to add a specific list of IPs for which I would like to get an email from Fail2ban after they make a couple of "GET" requests. The pattern to look for in apache's access logs is ^1.2.3.4 ...
0
votes
1answer
1k views

How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?

Fail2Ban on Ubuntu 10.04 Configuration files /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1 bantime = 10 # made for test purposes maxretry = 3 backend = polling destemail = ...
-3
votes
2answers
2k views

Logrotate error for fail2ban

I get the following error when running a cron job, and I'm not too sure how to go about fixing. This is on Ubuntu 12.04 LTS. test -x /usr/sbin/anacron || ( cd / && run-parts --report ...
0
votes
0answers
422 views

How to protect Nginx from HULK DoS tool

There is a tool called HULK (Http Unbearable Load King). It's a web server denial of service tool. It is designed to generate volumes of unique and obfuscated traffic at a webserver, bypassing caching ...
1
vote
2answers
258 views

Strange java user agent in access.log

I recently noticed a huge load on my main production server, after some log parsing i stumbled upon a large number of those user agents originate from about 20 different IPs: 173.244.182.194 - - ...
2
votes
2answers
468 views

Is there any reason to use fail2ban with SSH password logins disabled?

I am setting up an Ubuntu server hosted by Linode. I am stepping through their security guide and they recommend installing fail2ban after disabling password based SSH logins. I don't see the point ...
0
votes
1answer
845 views

Anti-DDos Apache2 Fail2ban regex rule [duplicate]

I have fail2ban up and running, but my Failregex doesnt match anything, something is wrong. Request which i like to ban look like this: 186.6.65.199 - - [06/May/2013:18:46:21 +0400] "GET / HTTP/1.1" ...
1
vote
2answers
151 views

Run fail2ban without banning

It is possible to run fail2ban in some kind of "simulation mode" so it does not ban but log somewhere who it would have ban? Running fail2ban on Ubuntu 12.04.
0
votes
0answers
265 views

Fail2ban fails to parse logs, no error, no warning, no banning on CentOS

Using latest build (0.8.8) on CentOS i've setup fail2ban to filter Kerio spam/harvest attacks. Here's my kerio.conf [INCLUDES] before = common.conf [Definition] failregex = .*SMTP connection from ...
2
votes
2answers
128 views

Can Fail2Ban recognise failed logins to locked accounts?

I have locked the root account on my server with passwd -l root and so an attempted login results in the following in /var/log/auth.log: User root not allowed because account is locked Fail2Ban ...
7
votes
1answer
3k views

Installing from EPEL on Amazon EC2

I am trying to install fail2ban on our Amazon EC2 Linux AMI (CentOS). I know that fail2ban is in the EPEL so I have done the following: wget ...
1
vote
1answer
316 views

Does fail2ban monitor rotated log files?

Does fail2ban continue to monitor rotated log files? For example, I have a rule monitoring /var/log/fail2ban.log which is automatically rotated by the system every week (7 days). I want to have a ...
3
votes
1answer
2k views

fail2ban cannot ban ip on all ports if it's already banned for specific port

I'm using a custom filter in fail2ban to search through it's own log and ban an ip after 5 bans from any of the regular filters. I'm using iptables-allports as action for this. All other filters are ...
1
vote
0answers
119 views

Fail2ban on Ubuntu 11.10 does not ban custom filter/jail

An application I'm running logs incorrect logins such as this: Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 ...
7
votes
2answers
5k views

How to set up fail2ban to read multi log in a jail?

How can I configure multiple logpaths for the same rule? I'm trying to write a syntax like this: [apache-w00tw00t] enabled = true filter = apache-w00tw00t action = iptables-allports logpath = ...
1
vote
2answers
891 views

Setting up fail2ban to ignore connections behind a dynamic IP

Using fail2ban to secure an Ubuntu 12.04 x64 Server on DigitalOcean, while editing /etc/fail2ban/jail.local there's this part: [DEFAULT] # "ignoreip" can be an IP address, a CIDR mask or a DNS host ...
-1
votes
1answer
786 views

Fail2ban memory usage

Since my server is under a sustain DNS amplification attack (DDOS), I configured fail2ban and initially my outgoing traffic dropped markedly. Anyway, after a few hours (mostly +10), fail2ban uses ...
3
votes
2answers
2k views

fail2ban custom action to permanent ban IPs from China

When a IP address gets banned how can I check if the banned IP address is from China. If yes, then add it to the permanent ban list. I have found this nice guide which write the banned IP to file. ...
5
votes
1answer
1k views

measures to take against a dns amplification attack

I recently discovered that my server was being used as part of a DNS DDOS. Basically, my BIND setup allowed recursion, and it was used to attack a certain IP address using IP spoofing. I took the ...