Tagged Questions

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

1
vote
1answer
737 views

How can I use fail2ban to block scrapers?

I have a media site and problems of users coming along and scraping all of the content.I placed a invisible URL on the page to catch spiders that immediately blocks the ip, but some people have ...
1
vote
1answer
145 views

fail2ban on Ubuntu (defaults okay?)

I run an Ubuntu-based web-server (LAMP) and have installed fail2ban. Does it have sensible defaults to restrict malicious activity via SSH and any LAMP ports out-of-the-box? Or, does it need to be ...
1
vote
1answer
326 views

What regular expression can I use to identify invalid file requests in nginx logs?

I need help configuring a regular expression for fail2ban. I use my web server primarily for simple podcast file hosting but I see a lot of invalid requests for php, asp, and pl files in the logs. ...
1
vote
1answer
296 views

Basic Apache Log Regex

I'm struggling to match Fail2Ban's failregex on Apache logs using only the HTTP return codes. The log format I'm using is below and in that example it's the field showing "200". As long as the other ...
2
votes
5answers
5k views

Stop fail2ban stop/start notifications

If the server is restarted, or even if fail2ban is stopped/start it sends a notification. [asterisk-iptables] enabled = true filter = asterisk action = iptables-allports[name=ASTERISK, ...
3
votes
1answer
2k views

How to use fail2ban to parse Nginx access log to count 404's and ban ip addresses?

How can I use fail2ban to parse Nginx access log to count 404's and 502's, and ban ip addresses with too many requests?
8
votes
3answers
4k views

How do I setup monitoring of MySQL with Fail2ban?

Searching the internet with search engines on MySQL and fail2ban yields lots of results on putting your fail2ban logs into MySQL, however I'm wanting to monitor failed MySQL attempts to log in and ban ...
2
votes
3answers
646 views

fail2ban bans me after a series of *successful* logins

I created a passwordless ssh login for one of my servers by using the authorized_keys file. The server has fail2ban on it, and I noticed that after several successful logins I could no longer log in ...
2
votes
2answers
3k views

fail2ban: stop pop3 login attempts?

How do I set up fail2ban so that all those pesky pop3 login attempts are taken care of? I am using Ubuntu 9.04 and here's an extract from the pop3 log as I see it in the mails that Logwatch sends: ...
6
votes
5answers
3k views

Is it worth the effort to block failed login attempts

Is it worthwhile running fail2ban, sshdfilter or similar tools, which blacklist IP addresses which attempt and fail to login? I've seen it argued that this is security theatre on a "properly ...
2
votes
2answers
2k views

fail2ban for apache2 doesn't seem to be working

I have a lot of the following error messages in my apache error log: [Thu Dec 16 15:13:24 2010] [error] [client 168.144.92.191] File does not exist: /var/www/mydomain/fud [Thu Dec 16 15:13:24 2010] ...
2
votes
1answer
895 views

Is it possible to rate limit HTTP requests with iptables?

I've got a lot of vulnerability scans via HTTP requests (trying to get /password.txt, etc). Currently I use fail2ban to parse Nginx access log to count 404's and ban attacker ip addresses. I'm ...
1
vote
2answers
248 views

SSHD logs events in the future

I'm setting up a small VPS (last Centos) and I'm facing a problem with my SSHD logs. I want to install fail2ban and everything seems to run fine, but I noticed a lot of attempts of bruteforce in the ...
7
votes
4answers
5k views

Permanently and persistently ban an IP with fail2ban

I have set up a custom jail for a spambot that is giving me trouble. Using "bantime -1" I was trying to permanently ban the botnet. I thought it was working, but when the weekly logrotate occured ...
3
votes
3answers
849 views

The right way to auto block ip's

The problem: I manage a website which has lot's of dynamically generated pages. Every day bots from Google, Yahoo and other search engines download like 100K+ of pages. And sometimes i have problems ...
0
votes
1answer
824 views

fail2ban not working as expected

after several intentional unsuccessful login attempts fail2ban has banned me from my server but I am still able to log in afterwards. # iptables -L Chain INPUT (policy ACCEPT) target prot opt ...
1
vote
2answers
2k views

fail2ban save banned ip's after restart

It is possible to save and use _already banned IP's in fail2ban after restart (fail2ban or the whole server)?
8
votes
5answers
1k views

is fail2ban safe? Better to use ssh keys?

I'm in doubt if I should use key authentication when logging into SSH, or just go for fail2ban + ssh (root login disabled). Is fail2ban safe or is it really better to just go ahead and generate keys ...
4
votes
6answers
3k views

fail2ban and denyhosts constantly ban me on Ubuntu

I just got an Ubuntu instance on Linode. To secure the SSH on it, I installed fail2ban (using apt-get), but then had a problem: fail2ban kept banning my IP (for limited durations, thankfully) even ...
1
vote
1answer
515 views

Any non-custom way to manage iptables with fail2ban and libvirt+kvm?

I have an Ubuntu 9.04 server running libvirt/kvm and fail2ban (for SSH attacks). Both libvirt and fail2ban integrate with iptables in different ways. Libvirt uses (I think) some XML config and ...
27
votes
7answers
20k views

Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

I'm setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I've seen many recommendations for both denyhosts and fail2ban, but few comparisons of the ...
3
votes
1answer
461 views

is there any valid reason for users to request phpinfo()

I'm working on writing a set of rules for fail2ban to make life a little more interesting for whoever is trying to bruteforce his way into my system. A good majority of the attempts tend to revolve ...
0
votes
1answer
2k views

Configure Fail2ban to ignore local (NAT) IPs

How can I configure fail2ban to always allow attempts from the local/NAT ips (ie 192.168.1.*). I have tried putting the following entry into /etc/fail2ban/jail.conf: [DEFAULT] # "ignoreip" can be ...
2
votes
2answers
926 views

“Couldn't find package fail2ban”?

Ubuntu Server 9.10 Hi Guys, I think this one is a simple one... I'm trying to install fail2ban and get the following error: $ sudo apt-get install fail2ban Reading package lists... Done Building ...
1
vote
3answers
2k views

fail2ban Error Gentoo

I've recently setup a new VPS running Gentoo (My first time using the distro so please forgive me is this is a really easy one) and as I've done with other servers installed fail2ban. Setting it up to ...