Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

1
vote
1answer
1k views

fail2ban bad bots apache access log regex

Trying to block some bad bots using fail2ban reading Apache access log and stuck setting up correct regex. The line I want to match in the access log is: 5.10.83.65 - - [18/Mar/2014:09:06:38 +0400] ...
1
vote
1answer
1k views

Fail2Ban Testing

Running the following testing script to see if Fail2ban is working: fail2ban-regex /var/log/apache*/*access.log /etc/fail2ban/filter.d/apache-auth.conf I get this response: Running tests ...
1
vote
2answers
258 views

Strange java user agent in access.log

I recently noticed a huge load on my main production server, after some log parsing i stumbled upon a large number of those user agents originate from about 20 different IPs: 173.244.182.194 - - ...
1
vote
1answer
316 views

Does fail2ban monitor rotated log files?

Does fail2ban continue to monitor rotated log files? For example, I have a rule monitoring /var/log/fail2ban.log which is automatically rotated by the system every week (7 days). I want to have a ...
1
vote
3answers
2k views

Setting up fail2ban to ban failed phpMyAdmin login attempts

We've been using fail2ban to block failed ssh attempts. I would like to setup the same thing for phpMyAdmin as well. As phpMyAdmin doesn't log authentication attempts to a file (that I know of), I'm ...
1
vote
1answer
67 views

Fail2ban critical exception - does not block ips

I'm trying to get fail2ban running on CentOS7 (no SELinux) and it uses firewalld. My goal is to set it to ban Asterisk password fails. Setup was default yum install fail2ban Config-wise I ONLY added ...
1
vote
1answer
176 views

How to interpret postfix logs on Ubuntu

I just installed postfix on my server which runs Ubuntu 14.04.1 LTS. I am a little confused as to how I should interpret the postfix logs located at /var/log/mail.log. Firstly, one of the reasons I ...
1
vote
1answer
50 views

Debian Fail2ban action.d and filter.d scripts

I have a debian wheezy server on which I use Fail2ban that was loaded with the package installer. I noticed that while the version on my server (0.8.6-3wheezy3) is current, it does not match up with ...
1
vote
1answer
76 views

Debian port(s) not responding

I am fairly new to servers. I am trying to run a shoutcast server on debian. Shoutcast runs on a default port of 8000. My problem is it will not load when visiting xxx.xxx.xx.xxx:8000. When I log in ...
1
vote
1answer
1k views

How to ban Syn Flood Attacks using Fail2Ban?

In my log, I am frequently seeing dropped ips like this: > Oct 30 17:32:24 IPTables Dropped: IN=eth0 OUT= > MAC=04:01:2b:bd:b0:01:4c:96:14:ff:df:f0:08:00 SRC=62.210.94.116 > ...
1
vote
1answer
144 views

fail2ban flushing my existing IPTABLES rules

I just implemented fail2ban on a server for testing purposes. I have a BLACKLIST chain which blocks a huge set of CIDR masks that I don't want to reach my server. When fail2ban is triggered by a ...
1
vote
1answer
346 views

Trouble with Fail2Ban UFW Portscan Filter

I'm trying to create a filter for fail2ban that recognises port scans in the UFW logs. I've confirmed my ban action is working correctly on other filters and am having trouble creating the correct ...
1
vote
2answers
294 views

Fail2ban and X-Forwarded

I am configuring fail2ban on my webservers. My Webservers are behind ELB. so I configured X-forwarded to get the real IP's in Apache Access logs.But unfortunately fail2ban not able scan accesslogs ...
1
vote
1answer
1k views

fail2ban regex working but no action being taken

I have the following snippet of fail2ban configuration on Ubuntu 13.10 server: #jail.conf [apache-getphp] enabled = true port = http,https filter = apache-getphp action = ...
1
vote
1answer
41 views

How to configure fail2ban for constant refreshes

I have a page that shows election results. Some people who want to see these election results will keep clicking refresh as election night goes on. I don't want to block this traffic -- but I do want ...
1
vote
1answer
1k views

fail2ban jail not firing

Used fail2ban in a few different methods, and have now tried to get it to block hack attempts via smtp for sending spam through server. Regex matches ok when testing: Failregex |- Regular ...
1
vote
1answer
643 views

fail2ban ignoreip DNS host example?

I would like to add ".googlebot.com" to the ignore iplist for fail2ban since the ignoreip explanation mentions DNS host as an accepted input. Is this a proper format? # "ignoreip" can be an IP ...
1
vote
1answer
139 views

fail2ban with bridge-util

Hello and happy new year, I am wondering if I can use fail2ban on a virtual host that uses bridge-util. I am using LXC containers for virtualization and have therefore direct access to all the log ...
1
vote
2answers
3k views

Connection refused after installing vsftp on Ubuntu 8.04 with fail2ban

I have been using an Ubuntu 8.04 server with fail2ban for a while now (12+ months) and using ftp over SSH without any problems. I have a new user that needs to put files onto the server from an IP ...
1
vote
1answer
147 views

fail2ban on Ubuntu (defaults okay?)

I run an Ubuntu-based web-server (LAMP) and have installed fail2ban. Does it have sensible defaults to restrict malicious activity via SSH and any LAMP ports out-of-the-box? Or, does it need to be ...
1
vote
1answer
380 views

What regular expression can I use to identify invalid file requests in nginx logs?

I need help configuring a regular expression for fail2ban. I use my web server primarily for simple podcast file hosting but I see a lot of invalid requests for php, asp, and pl files in the logs. ...
1
vote
1answer
312 views

Basic Apache Log Regex

I'm struggling to match Fail2Ban's failregex on Apache logs using only the HTTP return codes. The log format I'm using is below and in that example it's the field showing "200". As long as the other ...
1
vote
1answer
593 views

Any non-custom way to manage iptables with fail2ban and libvirt+kvm?

I have an Ubuntu 9.04 server running libvirt/kvm and fail2ban (for SSH attacks). Both libvirt and fail2ban integrate with iptables in different ways. Libvirt uses (I think) some XML config and ...
1
vote
1answer
202 views

Fail2ban configuration for nginx using firewallcmd in CentOS 7

Previously I have a CentOS 6.5 with Iptables and I configure some jails for nginx as suggested here: How To use fail2ban for Nginx?. But now I am in CentOS 7, trying to use the new firewall and ...
1
vote
0answers
75 views

What this error means on Fail2ban?

I've installed fail2ban on my server. Anyway, I've seen this error on Fail2ban Log... What does it means? Here's the error 2015-02-09 06:11:21,076 fail2ban.filter [23563]: INFO ...
1
vote
0answers
118 views

Apache blocking based on combination of ip, request and useragent - Can fail2ban do that?

3 times over the past 48 hours, we had about a 6X spike in traffic lasting a few hours. The server handled it each time, but just barely. This was almost all bad-bot traffic (or maybe failed DOS ...
1
vote
1answer
213 views

Fail2ban on centos 7 does not add rule to firewall. Firewall-cmd used on system

I installed the latest fail2ban from centos/epel I have added the ssh enabled option in jail.local. I have tried with action and banaction = firewallcmd-ipset neither made any difference. ...
1
vote
0answers
502 views

Fail2ban not banning IP's

Running a new install of OpenSuse 13.2 (Running rsyslog) My jail.conf file contains: [ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] ...
1
vote
0answers
302 views

Fail2Ban Correctly Attempts to Ban IP but IP does not get banned - iptables chain exists but not working

Running on Ubuntu 14.04 Server. So I have fail2ban correctly configured to process /var/log/auth.log for SSH login attempts. Upon 3 failed attempts I see this in the fail2ban log: 2014-11-19 ...
1
vote
0answers
97 views

Is fail2ban working?

I recently installed 2 new servers with Centos 7. I have enabled fail2ban with defaults. I have ensured it is running as ps -ax | grep fail2ban yields: 1996 ? S 0:04 /usr/bin/python ...
1
vote
0answers
226 views

How to protect tomcat application - user authentication with fail2ban?

AFAIK tomcat6 does not use Apache std .htaccess auth, but has own user authentication method. My question is: How to protect it against brute force attack with fail2ban ?
1
vote
1answer
178 views

fail2ban jail not working properly

I'm trying to block non-available script requests to nginx with fail2ban. # Noscript filter /etc/fail2ban/filter.d/nginx-noscript.conf: # # Block IPs trying to execute scripts such as .php, .pl, ...
1
vote
0answers
171 views

nginx with fail2ban and mod_security

I forgot to update my fail2ban config for nginx. I just moved to nginx from apache. Today, I got a lot of cals from a single IP. IP tried to access login pages with post and get methods IP tried to ...
1
vote
1answer
48 views

Fail2ban still adding to log after uninstall

I am running a CentOS6 VM and I have been playing with Fail2ban, upon removing the service from my server I can see that it appears to be still posting logs to the /var/log/maillog Here is a link a ...
1
vote
0answers
299 views

How to Exclude Log Using Fail2Ban logpath with Wildcard Settings

I'm using wildcard in the logpath value as shown below: [http-get-dos] enabled = true filter = http-get-dos logpath = /var/log/ispconfig/httpd/*/access.log maxretry = 250 findtime = 300 #ban for 10 ...
1
vote
0answers
119 views

Fail2ban on Ubuntu 11.10 does not ban custom filter/jail

An application I'm running logs incorrect logins such as this: Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 ...
1
vote
2answers
260 views

SSHD logs events in the future

I'm setting up a small VPS (last Centos) and I'm facing a problem with my SSHD logs. I want to install fail2ban and everything seems to run fine, but I noticed a lot of attempts of bruteforce in the ...
0
votes
1answer
98 views

Fail2ban detects attempts from permanently banned IPs

I have a VM with a custom firewall script and Fail2ban. I've identified some IP ranges that make permanent intrusion attempts so I blocked them directly in my firewall script. Here is a simplified ...
0
votes
1answer
2k views

Fail2Ban not blocking brute force attack on dovecot

I run a CentOS 5 server with fail2ban and I am currently getting hit with a bruteforce attack on my dovecot service. I know fail2ban is working, because it is blocking attacks on my FTP server and ...
0
votes
1answer
741 views

Use fail2ban for Samba

I'm looking for a way to use fail2ban to control/block samba logins on Ubuntu 12.04.3 LTS. I already set up an jail.local. The samba part currently looks like this: [samba] enabled = true port = ...
0
votes
1answer
1k views

Fail2ban MTA=Postfix Setting in Jail Config giving Error

In /etc/fail2ban/jail.local, when I have the MTA setting to Postfix, Fail2Ban is showing an error and is unable to start. [DEFAULT] ignoreip = 127.0.0.1/8 bantime = 1800 ...
0
votes
1answer
148 views

Fail2ban Custom Port

I have a rule like this in my jail.local file: [ssh-ddos] enabled = true port = ssh,sftp filter = sshd-ddos logpath = /var/log/messages maxretry = 4 If I want to use a custom port for SSH, ...
0
votes
1answer
870 views

fail2ban not working as expected

after several intentional unsuccessful login attempts fail2ban has banned me from my server but I am still able to log in afterwards. # iptables -L Chain INPUT (policy ACCEPT) target prot opt ...
0
votes
1answer
15 views

Fail2Ban Filter Errors

I'm trying to add two fail2ban filters, one for post flood and phpmyadmin brute force but i get the following errors. logs: fail2ban.filter : ERROR No 'host' group in '[[]client []] File does not ...
0
votes
1answer
47 views

Modify fail2ban failregex to match failed public key authentications via ssh

fail2ban doesn't recognize failed public key ssh logins and I assume that this can be solved by modifying the failregex of /etc/fail2ban/filter.d/sshd.config to match the following line: <date> ...
0
votes
1answer
71 views

Loading fail2ban rules to iptables using iptables-persistent

I am using iptables-persistent package to reload my iptables on boot. And I have been thinking should I add the fail2ban rules to the loaded config file? Now I am seeing they are duplicated. This is ...
0
votes
1answer
69 views

Setup fail2ban with apf

Along with BFD we have recently installed fail2ban on our server, it is CentOS and it uses APF to block IPs. I have hunted online on how to get the two to work however when an IP is blocked by ...
0
votes
2answers
49 views

Massive blockingof ips done right

I run a website which is being abused every day with bots trying to send spam, not respecting robots.txt and so on. The biggest problem, however is repeating attempts to massively harvest website. ...
0
votes
1answer
88 views

Fail2Ban: I'm having trouble creating a regex for my Dovecot filter

I am trying to create a regex filter for my failed Dovecot entries in the maillog file. What I have created is: .*dovecot: auth: sql\(.*,<HOST>\): Password mismatch The target line in the ...
0
votes
1answer
138 views

How to configure fail2ban so it bans login attempts based on the structure of the attempted password or username

I want to set up two filters for fail2ban: If the user tries to login with a password that is less than 10 characters ban them. And if the user tries to login with a password that is more than 10 ...