Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

7
votes
4answers
12k views

In Fail2Ban, How to Change the SSH port number?

In my server, the ssh port is not the standard 22. I have set a different one. If I setup fail2ban, will it be able to detect that port? How can I tell it to check that port rather than port 22? The ...
1
vote
1answer
1k views

How to add a jail for specific IPs in fail2ban?

I would like to add a specific list of IPs for which I would like to get an email from Fail2ban after they make a couple of "GET" requests. The pattern to look for in apache's access logs is ^1.2.3.4 ...
0
votes
1answer
1k views

Fail2ban not configuring properly

I have just installed a fresh version of iptables followed by fail2ban, but fail2ban fails to do anything with iptables and I am stuck with no changes being made, this fail2ban not working properly. ...
0
votes
0answers
420 views

How to protect Nginx from HULK DoS tool

There is a tool called HULK (Http Unbearable Load King). It's a web server denial of service tool. It is designed to generate volumes of unique and obfuscated traffic at a webserver, bypassing caching ...
1
vote
2answers
257 views

Strange java user agent in access.log

I recently noticed a huge load on my main production server, after some log parsing i stumbled upon a large number of those user agents originate from about 20 different IPs: 173.244.182.194 - - ...
2
votes
2answers
468 views

Is there any reason to use fail2ban with SSH password logins disabled?

I am setting up an Ubuntu server hosted by Linode. I am stepping through their security guide and they recommend installing fail2ban after disabling password based SSH logins. I don't see the point ...
0
votes
1answer
843 views

Anti-DDos Apache2 Fail2ban regex rule [duplicate]

I have fail2ban up and running, but my Failregex doesnt match anything, something is wrong. Request which i like to ban look like this: 186.6.65.199 - - [06/May/2013:18:46:21 +0400] "GET / HTTP/1.1" ...
0
votes
0answers
263 views

Fail2ban fails to parse logs, no error, no warning, no banning on CentOS

Using latest build (0.8.8) on CentOS i've setup fail2ban to filter Kerio spam/harvest attacks. Here's my kerio.conf [INCLUDES] before = common.conf [Definition] failregex = .*SMTP connection from ...
2
votes
2answers
127 views

Can Fail2Ban recognise failed logins to locked accounts?

I have locked the root account on my server with passwd -l root and so an attempted login results in the following in /var/log/auth.log: User root not allowed because account is locked Fail2Ban ...
7
votes
1answer
3k views

Installing from EPEL on Amazon EC2

I am trying to install fail2ban on our Amazon EC2 Linux AMI (CentOS). I know that fail2ban is in the EPEL so I have done the following: wget ...
1
vote
2answers
3k views

Connection refused after installing vsftp on Ubuntu 8.04 with fail2ban

I have been using an Ubuntu 8.04 server with fail2ban for a while now (12+ months) and using ftp over SSH without any problems. I have a new user that needs to put files onto the server from an IP ...
1
vote
0answers
119 views

Fail2ban on Ubuntu 11.10 does not ban custom filter/jail

An application I'm running logs incorrect logins such as this: Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 ...
2
votes
2answers
776 views

How to synchronize command calls on Linux

This is my specific problem I need to solve (But my question is different, so please read on even if you don't know what fail2ban is): I'm trying to use fail2ban on a linux server to ban brute force ...
9
votes
2answers
5k views

How do I setup monitoring of MySQL with Fail2ban?

Searching the internet with search engines on MySQL and fail2ban yields lots of results on putting your fail2ban logs into MySQL, however I'm wanting to monitor failed MySQL attempts to log in and ban ...
1
vote
2answers
887 views

Setting up fail2ban to ignore connections behind a dynamic IP

Using fail2ban to secure an Ubuntu 12.04 x64 Server on DigitalOcean, while editing /etc/fail2ban/jail.local there's this part: [DEFAULT] # "ignoreip" can be an IP address, a CIDR mask or a DNS host ...
4
votes
2answers
3k views

Fail2Ban - how to prevent my ISP IP dynamic get banned?

I have just installed Fail2Ban. I want to add my ISP IP to my ignore list but my IP is dynamic. In the jail.conf file, I have like this: [DEFAULT] # "ignoreip" can be an IP address, a CIDR mask or ...
-1
votes
1answer
783 views

Fail2ban memory usage

Since my server is under a sustain DNS amplification attack (DDOS), I configured fail2ban and initially my outgoing traffic dropped markedly. Anyway, after a few hours (mostly +10), fail2ban uses ...
5
votes
1answer
1k views

measures to take against a dns amplification attack

I recently discovered that my server was being used as part of a DNS DDOS. Basically, my BIND setup allowed recursion, and it was used to attack a certain IP address using IP spoofing. I took the ...
1
vote
1answer
420 views

Do we need PSAD if we already have Fail2Ban?

I already have installed Fail2Ban on my server. I planned to install PSAD on it. Are they equal? Isn't it a good idea to keep them both?
0
votes
1answer
965 views

Fail2Ban adds iptable rules but they are not working?

Fail2Ban just blocked my IP for 3 SSH attempts. It added the iptables rule and I can see it using the "sudo iptables -L -n" command. But I can still access the site and login through SSH! What might ...
2
votes
2answers
274 views

fail2ban-apache not blocking IP

I'm trying to configure fail2ban, I attempted to log into my web server numerous times to trigger the rule and looking at my iptables it seems to have worked: Chain fail2ban-apache (1 references) ...
1
vote
3answers
2k views

Setting up fail2ban to ban failed phpMyAdmin login attempts

We've been using fail2ban to block failed ssh attempts. I would like to setup the same thing for phpMyAdmin as well. As phpMyAdmin doesn't log authentication attempts to a file (that I know of), I'm ...
2
votes
2answers
620 views

iptables with Cloudflare

I'm using fail2ban to block web vulnerability scanners. It is working correctly when visiting the site if CloudFlare is bypassed, but a user can still access it if going through it. I have ...
-2
votes
2answers
574 views

Is it a good idea to disable Nginx access logs when it comes to security?

According to a blog post I found, disabling Nginx access log can speed things up. Nginx have to write to this file every time some one access the site. But, when setting up fail2ban, I realized that ...
2
votes
1answer
8k views

How To use fail2ban for Nginx? [closed]

How can I use fail2ban on an Nginx server? What are the rules to put in the jails.conf?
1
vote
1answer
380 views

What regular expression can I use to identify invalid file requests in nginx logs?

I need help configuring a regular expression for fail2ban. I use my web server primarily for simple podcast file hosting but I see a lot of invalid requests for php, asp, and pl files in the logs. ...
-1
votes
1answer
118 views

fail2ban Perform a regular expression for failregex [closed]

I needed some help to create a regular expression for failregex to find and ban the source ip (ex. SRC=192.168.0.1 and ban the IP 192.168.0.1) from this log: [ATT] Suspect: IN=eth0 OUT= ...
3
votes
1answer
236 views

fail2ban fails to ban most of the time, why could that be?

It does work, like 5 times out of 3000 or so. Running on Debian installed with apt-get and added only following jail.local file cat jail.local [ssh] enabled = true port = ssh filter = sshd ...
2
votes
1answer
268 views

Multiple IP Addresses in fail2ban

I just got a barrage of pop3-login attacks on one of my servers. I was surprised that fail2ban wasn't stopping them, then I realized that the service is listening on multiple IP addresses, and the ...
7
votes
4answers
5k views

Permanently and persistently ban an IP with fail2ban

I have set up a custom jail for a spambot that is giving me trouble. Using "bantime -1" I was trying to permanently ban the botnet. I thought it was working, but when the weekly logrotate occured ...
1
vote
3answers
2k views

fail2ban Error Gentoo

I've recently setup a new VPS running Gentoo (My first time using the distro so please forgive me is this is a really easy one) and as I've done with other servers installed fail2ban. Setting it up to ...
3
votes
1answer
495 views

fail2ban on server with LXC Containers

The issue is modprobe and iptables don't work inside an LXC Container. LXC is the userspace control package for Linux Containers, a lightweight virtual system mechanism sometimes described as ...
1
vote
1answer
2k views

Fail2ban don't want to start the server

I just installed fail2ban on my Ubuntu 10.04 server. I modified my jail.conf like this : http://pastebin.com/tEeM2hxe When i try to start the client it returns : ERROR Could not start server. ...
3
votes
1answer
4k views

Fail2ban unblock ipaddress

I am trying to unblock a IPaddress without restarting fail2ban each time, what is the best way of doing this? Or can you point me in the direction of a useful guide? As you can see below the IP ...
4
votes
1answer
2k views

How do I format this regex so it will work in fail2ban?

I've just installed fail2ban on my CentOS server in response to an SSH brute force attempt. The default regular expressions in fail2ban's sshd.conf file do not match any entries in audit.log, which ...
1
vote
3answers
620 views

Firewalls (ufw vs apf) on Ubuntu

On my LAMP servers, do either of the firewall interfaces (ufw or apt) allow you to setup rate limiting to automatically ban brute force attempts (e.g. via SSH)? Or, is it best to install fail2ban in ...
0
votes
1answer
172 views

Remove wait time of fail2ban after logfile read

We all know that in fail2ban after reading one log file it will wait for 1 second.the problem is that during that waiting time the attacker make lots of attack. so how can we remove this waiting ...
2
votes
3answers
2k views

Why isn't fail2ban blocking failures?

This below is the output of fail2ban log. Nothing more shows up, but in auth.log I see like hundreds of failures for root user login (someone is bad ass brute forcing). 2011-07-06 01:48:16,249 ...
0
votes
1answer
1k views

Vsftpd: log failed login attempts

I am setting up fail2ban for various services. Ssh went smoothly, but I have had no success with vsftpd so far. The problem is, that I can't find a way to get failed login attempts to appear in the ...
0
votes
2answers
349 views

SSH Authentication - Bruteforce attack prevention

I use certificate/key based ssh authentication with sshd running on non standard port. Do I still need to install denyhosts/fail2ban or log analysis based detection?. Do I get any advantage?
0
votes
1answer
1k views

fail2ban settings for apache

Basically at the moment our server is set a little too secure and fail2ban is banning users who are just browsing the website even if there is just a missing image for example. Which of the ...
3
votes
1answer
2k views

Fail2Ban SASL Filter Misses Failed Logins

I am using fail2ban on my mail server. I discovered this morning that there were some 5000 failed login attempts (in the course of 1 hour) via SMTP that didn't get picked up by my sasl filter. Here ...
0
votes
2answers
654 views

fail2ban regex to catch dovecot log entry?

Am trying to write a fail2ban regex that catches anyone who tries the user-id "administrador". For example, this log entry: Jan 2 09:55:01 mail2 dovecot: pop3-login: Disconnected: ...
1
vote
1answer
139 views

fail2ban with bridge-util

Hello and happy new year, I am wondering if I can use fail2ban on a virtual host that uses bridge-util. I am using LXC containers for virtualization and have therefore direct access to all the log ...
1
vote
2answers
631 views

Software vs. Hardware Appliance DDOS & Firewalls [duplicate]

I run several Ubuntu Servers (virtualized) and have fail2ban installed for DDOS mitigation. For a firewall, each server has iptables. I'm evaluating my security options and was wondering how well ...
3
votes
1answer
3k views

Fail2Ban: what is apache-overflows?

I am trying to configure fail2ban for my server and have come across: apache-overflows in the .config What does it do/protect against?
0
votes
2answers
279 views

Updating Hardware Firewall Rules From Fail2Ban?

I am a sysadmin and I was wondering if its possible to script or ideally use a built in feature to update a hardware firewall banned IP list from rules generated by fail2ban. I have done a bit of ...
2
votes
2answers
1k views

fail2ban regex that uses less CPU?

Using fail2ban, I want to ban these spammers who are sending to a spamtrap address: Oct 27 09:04:22 si68 postfix/smtpd[3240]: NOQUEUE: reject: RCPT from unknown[117.197.114.222]: 550 5.7.1 ...
8
votes
5answers
1k views

is fail2ban safe? Better to use ssh keys?

I'm in doubt if I should use key authentication when logging into SSH, or just go for fail2ban + ssh (root login disabled). Is fail2ban safe or is it really better to just go ahead and generate keys ...
0
votes
1answer
148 views

Fail2ban Custom Port

I have a rule like this in my jail.local file: [ssh-ddos] enabled = true port = ssh,sftp filter = sshd-ddos logpath = /var/log/messages maxretry = 4 If I want to use a custom port for SSH, ...