Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

1
vote
2answers
155 views

Fail2ban maxretry meaning

I'm reading the following page to set up fail2ban on my Ubuntu server: https://help.ubuntu.com/community/Fail2ban In the "Configuration" section, it shows the following settings: [DEFAULT] # ...
1
vote
1answer
4k views

fail2ban running on CentOS 7 & getting “ssh connection refused”

Is anyone successfully running fail2ban on CentOS 7 and can tell me how to do it? I tried to install fail2ban with yum install fail2ban and run it (there are no extra rules in iptables -L which seems ...
1
vote
1answer
1k views

How to add a jail for specific IPs in fail2ban?

I would like to add a specific list of IPs for which I would like to get an email from Fail2ban after they make a couple of "GET" requests. The pattern to look for in apache's access logs is ^1.2.3.4 ...
1
vote
1answer
149 views

fail2ban says banned, but can still log in

Running fail2ban 0.8.14 on CentOS 6.5 with Python 2.6.6, fail2ban puts my IP in the banned list, but doesn't actually prevent me from logging in. Here's an example of a failed ban in ...
1
vote
2answers
456 views

fail2ban error on setting iptables on Synology NAS

I setup fail2ban 0.9.1 on my Synology NAS to handle failed SSH attempts. When I startup the jail I get the following errors in fail2ban.log: 2015-02-01 17:22:52,394 fail2ban.jail [30576]: ...
1
vote
2answers
118 views

Use Fail2ban to block proxied dovecot password attempts

I've searched around a great deal with this, but can't manage to come up with a solution. The easiest way of explaining it, is I used to have just 1 email server, now I have 2. The 1st email server ...
1
vote
1answer
734 views

fail2ban-regex matches with strings, but not with log and conf files, why?

If I run fail2ban-regex '31.22.105.115 - - [11/Apr/2014:18:09:54 +0100] "GET /admin/config.php HTTP/1.0" 301 573 "-" "-"' '^<HOST> - - (?:\[[^]]*\] ...
1
vote
1answer
1k views

fail2ban bad bots apache access log regex

Trying to block some bad bots using fail2ban reading Apache access log and stuck setting up correct regex. The line I want to match in the access log is: 5.10.83.65 - - [18/Mar/2014:09:06:38 +0400] ...
1
vote
1answer
3k views

Fail2Ban Testing

Running the following testing script to see if Fail2ban is working: fail2ban-regex /var/log/apache*/*access.log /etc/fail2ban/filter.d/apache-auth.conf I get this response: Running tests ...
1
vote
2answers
297 views

Strange java user agent in access.log

I recently noticed a huge load on my main production server, after some log parsing i stumbled upon a large number of those user agents originate from about 20 different IPs: 173.244.182.194 - - ...
1
vote
1answer
364 views

Does fail2ban monitor rotated log files?

Does fail2ban continue to monitor rotated log files? For example, I have a rule monitoring /var/log/fail2ban.log which is automatically rotated by the system every week (7 days). I want to have a ...
1
vote
3answers
2k views

Setting up fail2ban to ban failed phpMyAdmin login attempts

We've been using fail2ban to block failed ssh attempts. I would like to setup the same thing for phpMyAdmin as well. As phpMyAdmin doesn't log authentication attempts to a file (that I know of), I'm ...
1
vote
1answer
41 views

Fail2Ban Not Banning on CentOS 7 with SELinux

On a LEMP stack with WordPress and the WP fail2ban plugin, WordPress authentication issues get logged to /var/log/messages perfectly fine. $ sudo fail2ban-client version 0.9.2 In the last couple ...
1
vote
1answer
35 views

fail2ban not mailing on Arch

I have 3 servers, 2 Debian and 1 Arch. As usual the Arch makes me work hard for the simple things. This time it's fail2ban. My installation of fail2ban is default, its version 0.9.3-3. To test if my ...
1
vote
1answer
599 views

Fail2ban not banning IP's

Running a new install of OpenSuse 13.2 (Running rsyslog) My jail.conf file contains: [ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] ...
1
vote
1answer
104 views

Debian Fail2ban action.d and filter.d scripts

I have a debian wheezy server on which I use Fail2ban that was loaded with the package installer. I noticed that while the version on my server (0.8.6-3wheezy3) is current, it does not match up with ...
1
vote
1answer
91 views

Debian port(s) not responding

I am fairly new to servers. I am trying to run a shoutcast server on debian. Shoutcast runs on a default port of 8000. My problem is it will not load when visiting xxx.xxx.xx.xxx:8000. When I log in ...
1
vote
1answer
1k views

How to ban Syn Flood Attacks using Fail2Ban?

In my log, I am frequently seeing dropped ips like this: > Oct 30 17:32:24 IPTables Dropped: IN=eth0 OUT= > MAC=04:01:2b:bd:b0:01:4c:96:14:ff:df:f0:08:00 SRC=62.210.94.116 > ...
1
vote
1answer
181 views

fail2ban flushing my existing IPTABLES rules

I just implemented fail2ban on a server for testing purposes. I have a BLACKLIST chain which blocks a huge set of CIDR masks that I don't want to reach my server. When fail2ban is triggered by a ...
1
vote
1answer
508 views

Trouble with Fail2Ban UFW Portscan Filter

I'm trying to create a filter for fail2ban that recognises port scans in the UFW logs. I've confirmed my ban action is working correctly on other filters and am having trouble creating the correct ...
1
vote
2answers
369 views

Fail2ban and X-Forwarded

I am configuring fail2ban on my webservers. My Webservers are behind ELB. so I configured X-forwarded to get the real IP's in Apache Access logs.But unfortunately fail2ban not able scan accesslogs ...
1
vote
1answer
2k views

fail2ban regex working but no action being taken

I have the following snippet of fail2ban configuration on Ubuntu 13.10 server: #jail.conf [apache-getphp] enabled = true port = http,https filter = apache-getphp action = ...
1
vote
1answer
45 views

How to configure fail2ban for constant refreshes

I have a page that shows election results. Some people who want to see these election results will keep clicking refresh as election night goes on. I don't want to block this traffic -- but I do want ...
1
vote
1answer
1k views

fail2ban jail not firing

Used fail2ban in a few different methods, and have now tried to get it to block hack attempts via smtp for sending spam through server. Regex matches ok when testing: Failregex |- Regular ...
1
vote
1answer
769 views

fail2ban ignoreip DNS host example?

I would like to add ".googlebot.com" to the ignore iplist for fail2ban since the ignoreip explanation mentions DNS host as an accepted input. Is this a proper format? # "ignoreip" can be an IP ...
1
vote
1answer
145 views

fail2ban with bridge-util

Hello and happy new year, I am wondering if I can use fail2ban on a virtual host that uses bridge-util. I am using LXC containers for virtualization and have therefore direct access to all the log ...
1
vote
2answers
4k views

Connection refused after installing vsftp on Ubuntu 8.04 with fail2ban

I have been using an Ubuntu 8.04 server with fail2ban for a while now (12+ months) and using ftp over SSH without any problems. I have a new user that needs to put files onto the server from an IP ...
1
vote
1answer
151 views

fail2ban on Ubuntu (defaults okay?)

I run an Ubuntu-based web-server (LAMP) and have installed fail2ban. Does it have sensible defaults to restrict malicious activity via SSH and any LAMP ports out-of-the-box? Or, does it need to be ...
1
vote
1answer
399 views

What regular expression can I use to identify invalid file requests in nginx logs?

I need help configuring a regular expression for fail2ban. I use my web server primarily for simple podcast file hosting but I see a lot of invalid requests for php, asp, and pl files in the logs. ...
1
vote
1answer
316 views

Basic Apache Log Regex

I'm struggling to match Fail2Ban's failregex on Apache logs using only the HTTP return codes. The log format I'm using is below and in that example it's the field showing "200". As long as the other ...
1
vote
0answers
15 views

Nginx: Logging 403's from proxies

So our server setup goes like this: www <-> nginx <-> backend services The internal services require authorisation, which often fails with a 403 if a user's token is incorrect and so ...
1
vote
0answers
48 views

Selinux: Shorewall will not respond to fail2ban

I am using fail2ban with shorewall and my Fedora 21 server & cloud. All flooded with the following error message: SELinux is preventing shorewall from write access on the file ...
1
vote
1answer
334 views

Fail2ban configuration for nginx using firewallcmd in CentOS 7

Previously I have a CentOS 6.5 with Iptables and I configure some jails for nginx as suggested here: How To use fail2ban for Nginx?. But now I am in CentOS 7, trying to use the new firewall and ...
1
vote
0answers
117 views

What this error means on Fail2ban?

I've installed fail2ban on my server. Anyway, I've seen this error on Fail2ban Log... What does it means? Here's the error 2015-02-09 06:11:21,076 fail2ban.filter [23563]: INFO ...
1
vote
0answers
165 views

Apache blocking based on combination of ip, request and useragent - Can fail2ban do that?

3 times over the past 48 hours, we had about a 6X spike in traffic lasting a few hours. The server handled it each time, but just barely. This was almost all bad-bot traffic (or maybe failed DOS ...
1
vote
1answer
273 views

Fail2ban on centos 7 does not add rule to firewall. Firewall-cmd used on system

I installed the latest fail2ban from centos/epel I have added the ssh enabled option in jail.local. I have tried with action and banaction = firewallcmd-ipset neither made any difference. ...
1
vote
0answers
595 views

Fail2Ban Correctly Attempts to Ban IP but IP does not get banned - iptables chain exists but not working

Running on Ubuntu 14.04 Server. So I have fail2ban correctly configured to process /var/log/auth.log for SSH login attempts. Upon 3 failed attempts I see this in the fail2ban log: 2014-11-19 ...
1
vote
0answers
121 views

Is fail2ban working?

I recently installed 2 new servers with Centos 7. I have enabled fail2ban with defaults. I have ensured it is running as ps -ax | grep fail2ban yields: 1996 ? S 0:04 /usr/bin/python ...
1
vote
0answers
128 views

What does Nginx Proxy Filter in Fail2ban really do?

What does Nginx Proxy Filter in Fail2ban really do? I am currently setting up Fail2Ban for Nginx. Almost everywhere I've read, they all have included a setting for [nginx-proxy] proxy filter. From ...
1
vote
0answers
280 views

How to protect tomcat application - user authentication with fail2ban?

AFAIK tomcat6 does not use Apache std .htaccess auth, but has own user authentication method. My question is: How to protect it against brute force attack with fail2ban ?
1
vote
1answer
200 views

fail2ban jail not working properly

I'm trying to block non-available script requests to nginx with fail2ban. # Noscript filter /etc/fail2ban/filter.d/nginx-noscript.conf: # # Block IPs trying to execute scripts such as .php, .pl, ...
1
vote
0answers
455 views

Blocking X-forwarded-For IP in fail2ban?

I am using a reverse proxy in front of my web-server. In the web server I installed fail2ban and want to use it to monitor logs and block bad ip. I am using nginx with the http realip module. But ...
1
vote
0answers
188 views

nginx with fail2ban and mod_security

I forgot to update my fail2ban config for nginx. I just moved to nginx from apache. Today, I got a lot of cals from a single IP. IP tried to access login pages with post and get methods IP tried to ...
1
vote
1answer
52 views

Fail2ban still adding to log after uninstall

I am running a CentOS6 VM and I have been playing with Fail2ban, upon removing the service from my server I can see that it appears to be still posting logs to the /var/log/maillog Here is a link a ...
1
vote
0answers
339 views

How to Exclude Log Using Fail2Ban logpath with Wildcard Settings

I'm using wildcard in the logpath value as shown below: [http-get-dos] enabled = true filter = http-get-dos logpath = /var/log/ispconfig/httpd/*/access.log maxretry = 250 findtime = 300 #ban for 10 ...
1
vote
0answers
128 views

Fail2ban on Ubuntu 11.10 does not ban custom filter/jail

An application I'm running logs incorrect logins such as this: Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 ...
1
vote
2answers
263 views

SSHD logs events in the future

I'm setting up a small VPS (last Centos) and I'm facing a problem with my SSHD logs. I want to install fail2ban and everything seems to run fine, but I noticed a lot of attempts of bruteforce in the ...
0
votes
1answer
859 views

Use fail2ban for Samba

I'm looking for a way to use fail2ban to control/block samba logins on Ubuntu 12.04.3 LTS. I already set up an jail.local. The samba part currently looks like this: [samba] enabled = true port = ...
0
votes
1answer
131 views

Fail2ban detects attempts from permanently banned IPs

I have a VM with a custom firewall script and Fail2ban. I've identified some IP ranges that make permanent intrusion attempts so I blocked them directly in my firewall script. Here is a simplified ...
0
votes
1answer
3k views

Fail2Ban not blocking brute force attack on dovecot

I run a CentOS 5 server with fail2ban and I am currently getting hit with a bruteforce attack on my dovecot service. I know fail2ban is working, because it is blocking attacks on my FTP server and ...