Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

0
votes
1answer
101 views

fail2ban doesnt permanently block

Fail2ban doesn't seem to block permanently. I have bantime =-1 but if i look a bit later on my iptables its just not there anymore all ill see is Chain fail2ban-ssh (1 references) target prot ...
0
votes
0answers
2k views

Fail2Ban + BIND to ban “DNS format error from X.X.X.X resolving something.com/MX for client Y.Y.Y.Y: invalid response” or not to ban?

Recently, the increased load on the DNS, to log a lot of records like this: 14-Aug-2013 17:14:22.834 resolver: notice: DNS format error from 204.13.160.143#53 resolving palactive.com/MX for ...
2
votes
3answers
5k views

fail2ban iptables having port 22 and fails to block ssh on custom port

This question is almost same problem like mine but accepted answer doesn't solve my issues In Fail2Ban, How to Change the SSH port number? SSH on port 22 everything works great. After 5 attempts ...
0
votes
1answer
722 views

How to block Bad robots, spiders, crawlers and harvesters

I'm sick and tired of this bad robots, spiders, crawlers and harvesters. I have already configured my server to block IP connected for 5 minutes and with maxretry of 250 using fail2ban. But still some ...
1
vote
0answers
308 views

How to Exclude Log Using Fail2Ban logpath with Wildcard Settings

I'm using wildcard in the logpath value as shown below: [http-get-dos] enabled = true filter = http-get-dos logpath = /var/log/ispconfig/httpd/*/access.log maxretry = 250 findtime = 300 #ban for 10 ...
1
vote
3answers
1k views

Fail2Ban on Apache Server to protect against DoS attacks?

I asked a question on the IT security StackExchange about protecting against DoS attacks. One of the answers was to install Fail2Ban. I talked to the people that administer the server and they told ...
0
votes
0answers
407 views

fail2ban is failing to ban apache IP pattern

I just noticed that fail2ban reports it 'banned' an IP address doing the following: 183.60.48.25 - - [03/Jul/2013:10:14:26 -0700] "GET http://www.baidu.com/ HTTP/1.1" 200 5112 183.60.48.25 - - ...
8
votes
4answers
13k views

In Fail2Ban, How to Change the SSH port number?

In my server, the ssh port is not the standard 22. I have set a different one. If I setup fail2ban, will it be able to detect that port? How can I tell it to check that port rather than port 22? The ...
1
vote
1answer
1k views

How to add a jail for specific IPs in fail2ban?

I would like to add a specific list of IPs for which I would like to get an email from Fail2ban after they make a couple of "GET" requests. The pattern to look for in apache's access logs is ^1.2.3.4 ...
0
votes
1answer
1k views

Fail2ban not configuring properly

I have just installed a fresh version of iptables followed by fail2ban, but fail2ban fails to do anything with iptables and I am stuck with no changes being made, this fail2ban not working properly. ...
0
votes
0answers
436 views

How to protect Nginx from HULK DoS tool

There is a tool called HULK (Http Unbearable Load King). It's a web server denial of service tool. It is designed to generate volumes of unique and obfuscated traffic at a webserver, bypassing caching ...
1
vote
2answers
272 views

Strange java user agent in access.log

I recently noticed a huge load on my main production server, after some log parsing i stumbled upon a large number of those user agents originate from about 20 different IPs: 173.244.182.194 - - ...
2
votes
2answers
485 views

Is there any reason to use fail2ban with SSH password logins disabled?

I am setting up an Ubuntu server hosted by Linode. I am stepping through their security guide and they recommend installing fail2ban after disabling password based SSH logins. I don't see the point ...
0
votes
1answer
892 views

Anti-DDos Apache2 Fail2ban regex rule [duplicate]

I have fail2ban up and running, but my Failregex doesnt match anything, something is wrong. Request which i like to ban look like this: 186.6.65.199 - - [06/May/2013:18:46:21 +0400] "GET / HTTP/1.1" ...
0
votes
0answers
271 views

Fail2ban fails to parse logs, no error, no warning, no banning on CentOS

Using latest build (0.8.8) on CentOS i've setup fail2ban to filter Kerio spam/harvest attacks. Here's my kerio.conf [INCLUDES] before = common.conf [Definition] failregex = .*SMTP connection from ...
2
votes
2answers
129 views

Can Fail2Ban recognise failed logins to locked accounts?

I have locked the root account on my server with passwd -l root and so an attempted login results in the following in /var/log/auth.log: User root not allowed because account is locked Fail2Ban ...
7
votes
1answer
3k views

Installing from EPEL on Amazon EC2

I am trying to install fail2ban on our Amazon EC2 Linux AMI (CentOS). I know that fail2ban is in the EPEL so I have done the following: wget ...
1
vote
2answers
4k views

Connection refused after installing vsftp on Ubuntu 8.04 with fail2ban

I have been using an Ubuntu 8.04 server with fail2ban for a while now (12+ months) and using ftp over SSH without any problems. I have a new user that needs to put files onto the server from an IP ...
1
vote
0answers
125 views

Fail2ban on Ubuntu 11.10 does not ban custom filter/jail

An application I'm running logs incorrect logins such as this: Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 ...
2
votes
2answers
799 views

How to synchronize command calls on Linux

This is my specific problem I need to solve (But my question is different, so please read on even if you don't know what fail2ban is): I'm trying to use fail2ban on a linux server to ban brute force ...
9
votes
2answers
6k views

How do I setup monitoring of MySQL with Fail2ban?

Searching the internet with search engines on MySQL and fail2ban yields lots of results on putting your fail2ban logs into MySQL, however I'm wanting to monitor failed MySQL attempts to log in and ban ...
1
vote
2answers
929 views

Setting up fail2ban to ignore connections behind a dynamic IP

Using fail2ban to secure an Ubuntu 12.04 x64 Server on DigitalOcean, while editing /etc/fail2ban/jail.local there's this part: [DEFAULT] # "ignoreip" can be an IP address, a CIDR mask or a DNS host ...
4
votes
2answers
3k views

Fail2Ban - how to prevent my ISP IP dynamic get banned?

I have just installed Fail2Ban. I want to add my ISP IP to my ignore list but my IP is dynamic. In the jail.conf file, I have like this: [DEFAULT] # "ignoreip" can be an IP address, a CIDR mask or ...
-1
votes
1answer
822 views

Fail2ban memory usage

Since my server is under a sustain DNS amplification attack (DDOS), I configured fail2ban and initially my outgoing traffic dropped markedly. Anyway, after a few hours (mostly +10), fail2ban uses ...
5
votes
1answer
1k views

measures to take against a dns amplification attack

I recently discovered that my server was being used as part of a DNS DDOS. Basically, my BIND setup allowed recursion, and it was used to attack a certain IP address using IP spoofing. I took the ...
1
vote
1answer
433 views

Do we need PSAD if we already have Fail2Ban?

I already have installed Fail2Ban on my server. I planned to install PSAD on it. Are they equal? Isn't it a good idea to keep them both?
0
votes
1answer
981 views

Fail2Ban adds iptable rules but they are not working?

Fail2Ban just blocked my IP for 3 SSH attempts. It added the iptables rule and I can see it using the "sudo iptables -L -n" command. But I can still access the site and login through SSH! What might ...
2
votes
2answers
277 views

fail2ban-apache not blocking IP

I'm trying to configure fail2ban, I attempted to log into my web server numerous times to trigger the rule and looking at my iptables it seems to have worked: Chain fail2ban-apache (1 references) ...
1
vote
3answers
2k views

Setting up fail2ban to ban failed phpMyAdmin login attempts

We've been using fail2ban to block failed ssh attempts. I would like to setup the same thing for phpMyAdmin as well. As phpMyAdmin doesn't log authentication attempts to a file (that I know of), I'm ...
2
votes
2answers
637 views

iptables with Cloudflare

I'm using fail2ban to block web vulnerability scanners. It is working correctly when visiting the site if CloudFlare is bypassed, but a user can still access it if going through it. I have ...
-2
votes
2answers
593 views

Is it a good idea to disable Nginx access logs when it comes to security?

According to a blog post I found, disabling Nginx access log can speed things up. Nginx have to write to this file every time some one access the site. But, when setting up fail2ban, I realized that ...
2
votes
1answer
9k views

How To use fail2ban for Nginx? [closed]

How can I use fail2ban on an Nginx server? What are the rules to put in the jails.conf?
1
vote
1answer
388 views

What regular expression can I use to identify invalid file requests in nginx logs?

I need help configuring a regular expression for fail2ban. I use my web server primarily for simple podcast file hosting but I see a lot of invalid requests for php, asp, and pl files in the logs. ...
-1
votes
1answer
119 views

fail2ban Perform a regular expression for failregex [closed]

I needed some help to create a regular expression for failregex to find and ban the source ip (ex. SRC=192.168.0.1 and ban the IP 192.168.0.1) from this log: [ATT] Suspect: IN=eth0 OUT= ...
3
votes
1answer
238 views

fail2ban fails to ban most of the time, why could that be?

It does work, like 5 times out of 3000 or so. Running on Debian installed with apt-get and added only following jail.local file cat jail.local [ssh] enabled = true port = ssh filter = sshd ...
2
votes
1answer
270 views

Multiple IP Addresses in fail2ban

I just got a barrage of pop3-login attacks on one of my servers. I was surprised that fail2ban wasn't stopping them, then I realized that the service is listening on multiple IP addresses, and the ...
7
votes
4answers
6k views

Permanently and persistently ban an IP with fail2ban

I have set up a custom jail for a spambot that is giving me trouble. Using "bantime -1" I was trying to permanently ban the botnet. I thought it was working, but when the weekly logrotate occured ...
1
vote
3answers
3k views

fail2ban Error Gentoo

I've recently setup a new VPS running Gentoo (My first time using the distro so please forgive me is this is a really easy one) and as I've done with other servers installed fail2ban. Setting it up to ...
3
votes
1answer
510 views

fail2ban on server with LXC Containers

The issue is modprobe and iptables don't work inside an LXC Container. LXC is the userspace control package for Linux Containers, a lightweight virtual system mechanism sometimes described as ...
1
vote
1answer
3k views

Fail2ban don't want to start the server

I just installed fail2ban on my Ubuntu 10.04 server. I modified my jail.conf like this : http://pastebin.com/tEeM2hxe When i try to start the client it returns : ERROR Could not start server. ...
3
votes
1answer
5k views

Fail2ban unblock ipaddress

I am trying to unblock a IPaddress without restarting fail2ban each time, what is the best way of doing this? Or can you point me in the direction of a useful guide? As you can see below the IP ...
4
votes
1answer
3k views

How do I format this regex so it will work in fail2ban?

I've just installed fail2ban on my CentOS server in response to an SSH brute force attempt. The default regular expressions in fail2ban's sshd.conf file do not match any entries in audit.log, which ...
1
vote
3answers
639 views

Firewalls (ufw vs apf) on Ubuntu

On my LAMP servers, do either of the firewall interfaces (ufw or apt) allow you to setup rate limiting to automatically ban brute force attempts (e.g. via SSH)? Or, is it best to install fail2ban in ...
0
votes
1answer
175 views

Remove wait time of fail2ban after logfile read

We all know that in fail2ban after reading one log file it will wait for 1 second.the problem is that during that waiting time the attacker make lots of attack. so how can we remove this waiting ...
2
votes
3answers
3k views

Why isn't fail2ban blocking failures?

This below is the output of fail2ban log. Nothing more shows up, but in auth.log I see like hundreds of failures for root user login (someone is bad ass brute forcing). 2011-07-06 01:48:16,249 ...
0
votes
1answer
2k views

Vsftpd: log failed login attempts

I am setting up fail2ban for various services. Ssh went smoothly, but I have had no success with vsftpd so far. The problem is, that I can't find a way to get failed login attempts to appear in the ...
0
votes
2answers
355 views

SSH Authentication - Bruteforce attack prevention

I use certificate/key based ssh authentication with sshd running on non standard port. Do I still need to install denyhosts/fail2ban or log analysis based detection?. Do I get any advantage?
0
votes
1answer
1k views

fail2ban settings for apache

Basically at the moment our server is set a little too secure and fail2ban is banning users who are just browsing the website even if there is just a missing image for example. Which of the ...
3
votes
1answer
3k views

Fail2Ban SASL Filter Misses Failed Logins

I am using fail2ban on my mail server. I discovered this morning that there were some 5000 failed login attempts (in the course of 1 hour) via SMTP that didn't get picked up by my sasl filter. Here ...
0
votes
2answers
655 views

fail2ban regex to catch dovecot log entry?

Am trying to write a fail2ban regex that catches anyone who tries the user-id "administrador". For example, this log entry: Jan 2 09:55:01 mail2 dovecot: pop3-login: Disconnected: ...