Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

0
votes
1answer
1k views

Fail2ban not configuring properly

I have just installed a fresh version of iptables followed by fail2ban, but fail2ban fails to do anything with iptables and I am stuck with no changes being made, this fail2ban not working properly. ...
0
votes
1answer
147 views

Fail2ban Custom Port

I have a rule like this in my jail.local file: [ssh-ddos] enabled = true port = ssh,sftp filter = sshd-ddos logpath = /var/log/messages maxretry = 4 If I want to use a custom port for SSH, ...
2
votes
2answers
883 views

Block IPs that try to exploit common webapp vulnerabilities

Is there an application that goes through the nginx logs and blocks IPs that made requests for common webapp vulnerabilities? I have an nginx web server that serves only static content. I routinely ...
0
votes
1answer
426 views

Have fail2ban client and server on different machines

I was wondering if it was possible to have fail2ban clients on different machines and have a server on one machine communicating with all the clients? Here's my situation: I have 4 servers and I'm ...
0
votes
1answer
350 views

fail2ban Service Crashing

I have a miss behaving fail2ban service on a very much live server. It'll tally up to 100% cpu usage after boot for about 30min then goes down to a stable 0.1% It freakin me out, something is crashing ...
2
votes
2answers
697 views

How to synchronize command calls on Linux

This is my specific problem I need to solve (But my question is different, so please read on even if you don't know what fail2ban is): I'm trying to use fail2ban on a linux server to ban brute force ...
1
vote
2answers
3k views

Connection refused after installing vsftp on Ubuntu 8.04 with fail2ban

I have been using an Ubuntu 8.04 server with fail2ban for a while now (12+ months) and using ftp over SSH without any problems. I have a new user that needs to put files onto the server from an IP ...
2
votes
1answer
499 views

Tools to block hack attempts in Apache

Currently I'm using Blockhosts & mod_evasive to "manage" minor attacks & spurious requests, I'm wondering if there is something better/more effective out there. Something that behaves like ...
2
votes
2answers
932 views

fail2ban doesn't process jail even though regex matches

I have trouble setting up fail2ban to check the nginx error log for failed http auth entries. Even though the provided failregex works, fail2ban just seems to skip the jail config. I've already tried ...
0
votes
1answer
1k views

Fail2Ban does not ban VSFTPD users

He guys, i run CentOS5.6 (final), and i just installed FAIL2BAN version (0.8.4-23.el5). I have set it up to ban SSH and VSFTPD attacks. As you can see here: http://pastebin.com/RLyzGgBe fail2ban has ...
1
vote
2answers
310 views

Fail2Ban direct to website

Is it possible to set fail2ban to direct banned ips to a webpage instead of breaking connection and getting the timed out errors?
2
votes
3answers
2k views

Why isn't fail2ban blocking failures?

This below is the output of fail2ban log. Nothing more shows up, but in auth.log I see like hundreds of failures for root user login (someone is bad ass brute forcing). 2011-07-06 01:48:16,249 ...
4
votes
1answer
3k views

How to test whether fail2ban can really send an email?

I have configured fail2ban but I would like to test sending of email. For example, I would like that I get email when fail2ban is started or stopped.
15
votes
6answers
25k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
1
vote
1answer
748 views

How can I use fail2ban to block scrapers?

I have a media site and problems of users coming along and scraping all of the content.I placed a invisible URL on the page to catch spiders that immediately blocks the ip, but some people have ...
1
vote
1answer
145 views

fail2ban on Ubuntu (defaults okay?)

I run an Ubuntu-based web-server (LAMP) and have installed fail2ban. Does it have sensible defaults to restrict malicious activity via SSH and any LAMP ports out-of-the-box? Or, does it need to be ...
1
vote
1answer
342 views

What regular expression can I use to identify invalid file requests in nginx logs?

I need help configuring a regular expression for fail2ban. I use my web server primarily for simple podcast file hosting but I see a lot of invalid requests for php, asp, and pl files in the logs. ...
1
vote
1answer
301 views

Basic Apache Log Regex

I'm struggling to match Fail2Ban's failregex on Apache logs using only the HTTP return codes. The log format I'm using is below and in that example it's the field showing "200". As long as the other ...
4
votes
5answers
5k views

Stop fail2ban stop/start notifications

If the server is restarted, or even if fail2ban is stopped/start it sends a notification. [asterisk-iptables] enabled = true filter = asterisk action = iptables-allports[name=ASTERISK, ...
3
votes
1answer
2k views

How to use fail2ban to parse Nginx access log to count 404's and ban ip addresses?

How can I use fail2ban to parse Nginx access log to count 404's and 502's, and ban ip addresses with too many requests?
8
votes
3answers
5k views

How do I setup monitoring of MySQL with Fail2ban?

Searching the internet with search engines on MySQL and fail2ban yields lots of results on putting your fail2ban logs into MySQL, however I'm wanting to monitor failed MySQL attempts to log in and ban ...
2
votes
3answers
674 views

fail2ban bans me after a series of *successful* logins

I created a passwordless ssh login for one of my servers by using the authorized_keys file. The server has fail2ban on it, and I noticed that after several successful logins I could no longer log in ...
2
votes
2answers
3k views

fail2ban: stop pop3 login attempts?

How do I set up fail2ban so that all those pesky pop3 login attempts are taken care of? I am using Ubuntu 9.04 and here's an extract from the pop3 log as I see it in the mails that Logwatch sends: ...
6
votes
5answers
3k views

Is it worth the effort to block failed login attempts

Is it worthwhile running fail2ban, sshdfilter or similar tools, which blacklist IP addresses which attempt and fail to login? I've seen it argued that this is security theatre on a "properly ...
2
votes
2answers
2k views

fail2ban for apache2 doesn't seem to be working

I have a lot of the following error messages in my apache error log: [Thu Dec 16 15:13:24 2010] [error] [client 168.144.92.191] File does not exist: /var/www/mydomain/fud [Thu Dec 16 15:13:24 2010] ...
2
votes
1answer
904 views

Is it possible to rate limit HTTP requests with iptables?

I've got a lot of vulnerability scans via HTTP requests (trying to get /password.txt, etc). Currently I use fail2ban to parse Nginx access log to count 404's and ban attacker ip addresses. I'm ...
1
vote
2answers
252 views

SSHD logs events in the future

I'm setting up a small VPS (last Centos) and I'm facing a problem with my SSHD logs. I want to install fail2ban and everything seems to run fine, but I noticed a lot of attempts of bruteforce in the ...
7
votes
4answers
5k views

Permanently and persistently ban an IP with fail2ban

I have set up a custom jail for a spambot that is giving me trouble. Using "bantime -1" I was trying to permanently ban the botnet. I thought it was working, but when the weekly logrotate occured ...
3
votes
3answers
854 views

The right way to auto block ip's

The problem: I manage a website which has lot's of dynamically generated pages. Every day bots from Google, Yahoo and other search engines download like 100K+ of pages. And sometimes i have problems ...
0
votes
1answer
842 views

fail2ban not working as expected

after several intentional unsuccessful login attempts fail2ban has banned me from my server but I am still able to log in afterwards. # iptables -L Chain INPUT (policy ACCEPT) target prot opt ...
1
vote
2answers
2k views

fail2ban save banned ip's after restart

It is possible to save and use _already banned IP's in fail2ban after restart (fail2ban or the whole server)?
8
votes
5answers
1k views

is fail2ban safe? Better to use ssh keys?

I'm in doubt if I should use key authentication when logging into SSH, or just go for fail2ban + ssh (root login disabled). Is fail2ban safe or is it really better to just go ahead and generate keys ...
4
votes
6answers
3k views

fail2ban and denyhosts constantly ban me on Ubuntu

I just got an Ubuntu instance on Linode. To secure the SSH on it, I installed fail2ban (using apt-get), but then had a problem: fail2ban kept banning my IP (for limited durations, thankfully) even ...
1
vote
1answer
528 views

Any non-custom way to manage iptables with fail2ban and libvirt+kvm?

I have an Ubuntu 9.04 server running libvirt/kvm and fail2ban (for SSH attacks). Both libvirt and fail2ban integrate with iptables in different ways. Libvirt uses (I think) some XML config and ...
27
votes
7answers
21k views

Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

I'm setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I've seen many recommendations for both denyhosts and fail2ban, but few comparisons of the ...
3
votes
1answer
462 views

is there any valid reason for users to request phpinfo()

I'm working on writing a set of rules for fail2ban to make life a little more interesting for whoever is trying to bruteforce his way into my system. A good majority of the attempts tend to revolve ...
0
votes
1answer
2k views

Configure Fail2ban to ignore local (NAT) IPs

How can I configure fail2ban to always allow attempts from the local/NAT ips (ie 192.168.1.*). I have tried putting the following entry into /etc/fail2ban/jail.conf: [DEFAULT] # "ignoreip" can be ...
2
votes
2answers
965 views

“Couldn't find package fail2ban”?

Ubuntu Server 9.10 Hi Guys, I think this one is a simple one... I'm trying to install fail2ban and get the following error: $ sudo apt-get install fail2ban Reading package lists... Done Building ...
1
vote
3answers
2k views

fail2ban Error Gentoo

I've recently setup a new VPS running Gentoo (My first time using the distro so please forgive me is this is a really easy one) and as I've done with other servers installed fail2ban. Setting it up to ...