Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

0
votes
1answer
237 views

Setup fail2ban with apf

Along with BFD we have recently installed fail2ban on our server, it is CentOS and it uses APF to block IPs. I have hunted online on how to get the two to work however when an IP is blocked by ...
1
vote
3answers
2k views

fail2ban rule results in “iptables returned 200” error message

I just tried to add a new fail2ban rule that is supposed to scan Apache2 error logs for suspicious file access attempts (People who try to access three common login urls that do not exist usually don'...
1
vote
1answer
662 views

Fail2ban configuration for nginx using firewallcmd in CentOS 7

Previously I have a CentOS 6.5 with Iptables and I configure some jails for nginx as suggested here: How To use fail2ban for Nginx?. But now I am in CentOS 7, trying to use the new firewall and ...
4
votes
3answers
3k views

Fail2Ban is not adding iptables rules

Fail2Ban is not adding iptables rules to block attackers. I'm running CentOS 6.5 (32 bit) Here's what I did: fail2ban was installed via yum using the epel repo I copied jail.conf to jail.local I ...
0
votes
2answers
947 views

fail2ban statistics? [closed]

Is there a program that parses fail2ban.log and produces some statistics? Or should I set out and write something custom for our hosts? We run mostly Debian and fail2ban with iptables.
2
votes
0answers
537 views

fail2ban fails to block from auth.log with directadmin [closed]

i'm using directadmin on a Ubuntu server. i recently installed Fail2Ban. but i'm still recieving "Brute-Force attack" email from directadmin. my jail.conf (only the auth.log jails!): [ssh] enabled =...
1
vote
1answer
573 views

Fail2ban on centos 7 does not add rule to firewall. Firewall-cmd used on system

I installed the latest fail2ban from centos/epel I have added the ssh enabled option in jail.local. I have tried with action and banaction = firewallcmd-ipset neither made any difference. iptables-...
1
vote
0answers
221 views

What this error means on Fail2ban?

I've installed fail2ban on my server. Anyway, I've seen this error on Fail2ban Log... What does it means? Here's the error 2015-02-09 06:11:21,076 fail2ban.filter [23563]: INFO [apache-...
1
vote
1answer
332 views

How to interpret postfix logs on Ubuntu

I just installed postfix on my server which runs Ubuntu 14.04.1 LTS. I am a little confused as to how I should interpret the postfix logs located at /var/log/mail.log. Firstly, one of the reasons I ...
2
votes
2answers
1k views

fail2ban error on setting iptables on Synology NAS

I setup fail2ban 0.9.1 on my Synology NAS to handle failed SSH attempts. When I startup the jail I get the following errors in fail2ban.log: 2015-02-01 17:22:52,394 fail2ban.jail [30576]: ...
3
votes
1answer
5k views

Fail2ban doesn't start [closed]

I've done some changes to the file /etc/fail2ban/jail.local (a copy of /etc/fail2ban/jail.conf) and saved, but now fail2ban doesn't start. If I erase jail.local, then it start again. So the problem is ...
0
votes
1answer
731 views

Have fail2ban client and server on different machines

I was wondering if it was possible to have fail2ban clients on different machines and have a server on one machine communicating with all the clients? Here's my situation: I have 4 servers and I'm ...
0
votes
1answer
646 views

Writing a fail2ban multiline regex

I've got some troublesome hosts trying it on with an SSH server I run, and I'm trying to ban them using fail2ban. Problem is, I haven't done much work with regexes, and even less with Python regexes. ...
0
votes
2answers
662 views

Fail2Ban Regex - Joomla / PHP5-FPM

i can't get a regex for fail2ban to work. I want to match the following: [Tue Jun 24 10:22:14.528987 2014] [fcgid:warn] [pid 22526:tid 139757615011584] [client IP:PORT] mod_fcgid: stderr: user admin ...
2
votes
1answer
118 views

fail2ban did not ban anything, regardless of the settings

this is the first time that i did not find a solution here. so, hopefully it can be solved. i've installed a fresh, new ubuntu minimal system (14.04) with ssh on it. Right after that i installed ...
1
vote
2answers
251 views

Fail2ban maxretry meaning

I'm reading the following page to set up fail2ban on my Ubuntu server: https://help.ubuntu.com/community/Fail2ban In the "Configuration" section, it shows the following settings: [DEFAULT] # "...
1
vote
0answers
234 views

Apache blocking based on combination of ip, request and useragent - Can fail2ban do that?

3 times over the past 48 hours, we had about a 6X spike in traffic lasting a few hours. The server handled it each time, but just barely. This was almost all bad-bot traffic (or maybe failed DOS ...
3
votes
1answer
207 views

What is the purpose of the _daemon directive in fail2ban?

A number of the filters that come with fail2ban have a _daemon directive, but there is no mention of it in the documentation and no reference to it in any of my jail definitions. What's it for?
0
votes
1answer
170 views

Fail2ban detects attempts from permanently banned IPs

I have a VM with a custom firewall script and Fail2ban. I've identified some IP ranges that make permanent intrusion attempts so I blocked them directly in my firewall script. Here is a simplified ...
11
votes
3answers
3k views

Banning IPv6 addresses

I am currently accustomed to using tools like fail2ban to keep unwanted traffic away from my servers by banning IPv4 addresses: too many bad log entries per IP, ban the IP. However when the world ...
0
votes
1answer
146 views

Fail2Ban: I'm having trouble creating a regex for my Dovecot filter

I am trying to create a regex filter for my failed Dovecot entries in the maillog file. What I have created is: .*dovecot: auth: sql\(.*,<HOST>\): Password mismatch The target line in the ...
0
votes
2answers
59 views

Massive blockingof ips done right

I run a website which is being abused every day with bots trying to send spam, not respecting robots.txt and so on. The biggest problem, however is repeating attempts to massively harvest website. ...
1
vote
2answers
98 views

fail2ban with static IP

Is there any point to running fail2ban to protect your SSH connection if you connect from a static IP? As far as I can see having fail2ban running means that you effectively open up port 22 to ...
1
vote
1answer
2k views

How to ban Syn Flood Attacks using Fail2Ban?

In my log, I am frequently seeing dropped ips like this: > Oct 30 17:32:24 IPTables Dropped: IN=eth0 OUT= > MAC=04:01:2b:bd:b0:01:4c:96:14:ff:df:f0:08:00 SRC=62.210.94.116 > DST=128.199.xxx....
1
vote
2answers
146 views

Use Fail2ban to block proxied dovecot password attempts

I've searched around a great deal with this, but can't manage to come up with a solution. The easiest way of explaining it, is I used to have just 1 email server, now I have 2. The 1st email server ...
7
votes
2answers
400 views

How to *add* rules in local fail2ban filter definition?

I have installed fail2ban as packaged by Debian on a server under my control. Since I have some failregexes from before, I'm putting those into the local filter definition file so they will be ...
1
vote
1answer
112 views

Debian Fail2ban action.d and filter.d scripts

I have a debian wheezy server on which I use Fail2ban that was loaded with the package installer. I noticed that while the version on my server (0.8.6-3wheezy3) is current, it does not match up with ...
1
vote
3answers
2k views

fail2ban error about python?

I have just installed fail2ban on my debian7 machine but whenever i start it i get a lot of error which seems to be about python? [....] Restarting authentication failure monitor: fail2banTraceback (...
1
vote
1answer
119 views

Debian port(s) not responding

I am fairly new to servers. I am trying to run a shoutcast server on debian. Shoutcast runs on a default port of 8000. My problem is it will not load when visiting xxx.xxx.xx.xxx:8000. When I log in ...
1
vote
0answers
205 views

Is fail2ban working?

I recently installed 2 new servers with Centos 7. I have enabled fail2ban with defaults. I have ensured it is running as ps -ax | grep fail2ban yields: 1996 ? S 0:04 /usr/bin/python /usr/...
0
votes
1answer
3k views

Fail2ban MTA=Postfix Setting in Jail Config giving Error

In /etc/fail2ban/jail.local, when I have the MTA setting to Postfix, Fail2Ban is showing an error and is unable to start. [DEFAULT] ignoreip = 127.0.0.1/8 bantime = 1800 ...
1
vote
0answers
200 views

What does Nginx Proxy Filter in Fail2ban really do?

What does Nginx Proxy Filter in Fail2ban really do? I am currently setting up Fail2Ban for Nginx. Almost everywhere I've read, they all have included a setting for [nginx-proxy] proxy filter. From ...
8
votes
1answer
4k views

Fail2ban jail.local vs jail.conf

Does jail.local file act as an override to jail.conf or as a replacement to jail.conf? When I was learning about Fail2Ban from tutorials, most of them usually say either to copy jail.conf to jail....
1
vote
1answer
275 views

fail2ban flushing my existing IPTABLES rules

I just implemented fail2ban on a server for testing purposes. I have a BLACKLIST chain which blocks a huge set of CIDR masks that I don't want to reach my server. When fail2ban is triggered by a ...
0
votes
1answer
208 views

Fail2ban not working on Ubuntu 12.04

I'm trying to implement fail2ban on a Ubuntu 12.04 x64 server. I've done the following: apt-get install fail2ban Made a copy of jail.conf in /etc/fail2ban/jail.conf.local here's an excerpt: [...
1
vote
1answer
5k views

fail2ban running on CentOS 7 & getting “ssh connection refused”

Is anyone successfully running fail2ban on CentOS 7 and can tell me how to do it? I tried to install fail2ban with yum install fail2ban and run it (there are no extra rules in iptables -L which seems ...
6
votes
4answers
3k views

How to block all root login attempts using denyhosts and or fail2ban?

I currently block all ssh logins using root. But I wanted to go the extra mile and block the ip address of the client who tried to login as root. I currently have denyhosts and fail2ban setup and ...
2
votes
0answers
88 views

Blocking bot by multi url pattern with fail2ban

I'm seeing a multi url pattern similar to following lines in nginx logs recently. GET / GET /somepath/ GET /otherpath/ GET / GET /somepath/ GET /otherpath/ ... I'm already using fail2ban for ...
0
votes
1answer
1k views

Fail2Ban - Iptables - Set does not exist

I have a very strange problem with fail2ban/iptables. Something is not working right, but I can't figoure out what. I have added this conf & and filter for fail2ban: [wordpress-register] enabled ...
7
votes
3answers
7k views

Why is iptables not blocking an ip address?

I have configured fail2ban to monitor a certain pattern of malicious traffic I'm getting and ban IP addresses associated. Everything seems to be working great -- the regex is matching the pattern ...
2
votes
2answers
235 views

Run fail2ban without banning

It is possible to run fail2ban in some kind of "simulation mode" so it does not ban but log somewhere who it would have ban? Running fail2ban on Ubuntu 12.04.
1
vote
1answer
960 views

Trouble with Fail2Ban UFW Portscan Filter

I'm trying to create a filter for fail2ban that recognises port scans in the UFW logs. I've confirmed my ban action is working correctly on other filters and am having trouble creating the correct ...
3
votes
1answer
940 views

How to use so called action variables in fail2ban?

I've seen a few mentions of these in the docs and misc scripts, but nothing concrete on exactly how they are used. Could anyone give me some examples? Is it just a case of myvar=7 . . . [ssh] ...
1
vote
0answers
364 views

How to protect tomcat application - user authentication with fail2ban?

AFAIK tomcat6 does not use Apache std .htaccess auth, but has own user authentication method. My question is: How to protect it against brute force attack with fail2ban ?
1
vote
1answer
4k views

Fail2Ban Testing

Running the following testing script to see if Fail2ban is working: fail2ban-regex /var/log/apache*/*access.log /etc/fail2ban/filter.d/apache-auth.conf I get this response: Running tests ...
0
votes
1answer
159 views

Brute force attacks with server's IP

I am running a Debian wheezy server with fail2ban installed, everything works as expected but recently my own server got banned. I added the server's IP in the exception row and it seems to work, but ...
0
votes
1answer
143 views

Logging 403 Rewrites for Brute Force Attacks

As explained in Wordpress Codec, I want to prevent brute force attacks for wp-login.php via RewritetRule. http://codex.wordpress.org/Brute_Force_Attacks#Deny_Access_to_No_Referrer_Requests Rather ...
0
votes
1answer
345 views

fail2ban block ports rules iptable

I just installed Ubuntu Server 14.04 and don't have much experience with IPtables. I am trying to get a basic setup going where I only accept SSH connections on port 22 and 2222. I actually have that ...
0
votes
1answer
192 views

SELinux problems running Expect script from fail2ban

I have an Expect script that works fine if I run it manually, but fails when run as an action from Fail2ban. The error message is as follows: spawn /usr/bin/telnet 192.168.242.1 The system has no ...
0
votes
1answer
1k views

fail2ban not working on apache Ubuntu

Nothing happens even though it detects in the logs. It does not block the IP. It works fine forVSFTP but not for apache. Please help. You can see the config and log below. jail.local config file: [...