Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

0
votes
1answer
141 views

How to configure fail2ban so it bans login attempts based on the structure of the attempted password or username

I want to set up two filters for fail2ban: If the user tries to login with a password that is less than 10 characters ban them. And if the user tries to login with a password that is more than 10 ...
0
votes
2answers
3k views

fail2ban apache-noscript not working

My debian server has come under attack recently and I've been poring over the logs to see what I can do to harden it. I've been running fail2ban for a while but I've noticed the apache-noscript jail ...
0
votes
1answer
967 views

Fail2Ban adds iptable rules but they are not working?

Fail2Ban just blocked my IP for 3 SSH attempts. It added the iptables rule and I can see it using the "sudo iptables -L -n" command. But I can still access the site and login through SSH! What might ...
0
votes
2answers
350 views

SSH Authentication - Bruteforce attack prevention

I use certificate/key based ssh authentication with sshd running on non standard port. Do I still need to install denyhosts/fail2ban or log analysis based detection?. Do I get any advantage?
0
votes
1answer
1k views

fail2ban settings for apache

Basically at the moment our server is set a little too secure and fail2ban is banning users who are just browsing the website even if there is just a missing image for example. Which of the ...
0
votes
2answers
654 views

fail2ban regex to catch dovecot log entry?

Am trying to write a fail2ban regex that catches anyone who tries the user-id "administrador". For example, this log entry: Jan 2 09:55:01 mail2 dovecot: pop3-login: Disconnected: ...
0
votes
1answer
3k views

Configure Fail2ban to ignore local (NAT) IPs

How can I configure fail2ban to always allow attempts from the local/NAT ips (ie 192.168.1.*). I have tried putting the following entry into /etc/fail2ban/jail.conf: [DEFAULT] # "ignoreip" can be ...
0
votes
1answer
61 views

fail2ban keeps trying to ban again

I have an issue getting fail2ban to do what I want. I use a action which bans the IP on CLoudFlare, that means that still a lot of requests get through until everything has been updated on ...
0
votes
1answer
76 views

Can't connect to Ubuntu VPS via SSH,SFTP

When I try to login to my VPS using SSH and SFTP it's not connect to the server. Then I power off and power on the VPS by the VPS provider control panel (digital ocean). Once it boot up, first few ...
0
votes
1answer
168 views

Regex for multiple sshd Received disconnect from … [preauth]

What fail2ban regex would catch logs like these? Apr 9 08:48:28 server sshd[1856]: Received disconnect from 43.255.190.117: 11: [preauth] Apr 9 09:06:05 server sshd[1936]: Received disconnect ...
0
votes
1answer
30 views

Cannot understand this example fail2ban rule

I'm trying to secure my admin and user login page from brute force attacks. I have setup iptables and the closest thing I can find which looks useful is this: jail file: [nginx-login] enabled = true ...
0
votes
1answer
123 views

Fail2ban not working on Ubuntu 12.04

I'm trying to implement fail2ban on a Ubuntu 12.04 x64 server. I've done the following: apt-get install fail2ban Made a copy of jail.conf in /etc/fail2ban/jail.conf.local here's an excerpt: ...
0
votes
1answer
507 views

Fail2Ban - Iptables - Set does not exist

I have a very strange problem with fail2ban/iptables. Something is not working right, but I can't figoure out what. I have added this conf & and filter for fail2ban: [wordpress-register] enabled ...
0
votes
1answer
105 views

Logging 403 Rewrites for Brute Force Attacks

As explained in Wordpress Codec, I want to prevent brute force attacks for wp-login.php via RewritetRule. http://codex.wordpress.org/Brute_Force_Attacks#Deny_Access_to_No_Referrer_Requests Rather ...
0
votes
1answer
140 views

fail2ban block ports rules iptable

I just installed Ubuntu Server 14.04 and don't have much experience with IPtables. I am trying to get a basic setup going where I only accept SSH connections on port 22 and 2222. I actually have that ...
0
votes
1answer
107 views

SELinux problems running Expect script from fail2ban

I have an Expect script that works fine if I run it manually, but fails when run as an action from Fail2ban. The error message is as follows: spawn /usr/bin/telnet 192.168.242.1 The system has no ...
0
votes
1answer
959 views

fail2ban not working on apache Ubuntu

Nothing happens even though it detects in the logs. It does not block the IP. It works fine forVSFTP but not for apache. Please help. You can see the config and log below. jail.local config file: ...
0
votes
2answers
307 views

Fail2Ban Regex - Joomla / PHP5-FPM

i can't get a regex for fail2ban to work. I want to match the following: [Tue Jun 24 10:22:14.528987 2014] [fcgid:warn] [pid 22526:tid 139757615011584] [client IP:PORT] mod_fcgid: stderr: user admin ...
0
votes
1answer
455 views

fail2ban not banning, time is off, how do I sync them?

In searching for why fail2ban is not banning patterns, I found that when I run /etc/init.d/fail2ban status it reports over an hour behind my 'date' command. 'date' says its: Tue Mar 18 20:45:02 MST ...
0
votes
1answer
1k views

Postfix fail2ban help.. I have a bad host but fail2ban won't block him

Hi I am using postfix plus fail2ban on Centos 6.5 but I am getting botted (I am not relaying but there you go) and for some reason fail2ban isn't able to cut the ip and block it this is 6/7 times a ...
0
votes
3answers
900 views

fail2ban error about python?

I have just installed fail2ban on my debian7 machine but whenever i start it i get a lot of error which seems to be about python? [....] Restarting authentication failure monitor: fail2banTraceback ...
0
votes
1answer
509 views

Point fail2ban to new log, without losing current bans?

I have logs in /var/log/syslog/YYYY-MM-DD/file.log files. New directories are created automatically by rsyslog, and logs are automatically put to new locations. Every day, I archive previous day of ...
0
votes
1answer
354 views

How to unban from fail2ban?

fail2ban banned my ip for SSH. In email I received that said I got banned via fail2ban after 5 attempts against SSH. Which is not even truth i wasn't even loging to SSH. I can still access webmin. I ...
0
votes
1answer
197 views

fail2ban iptable rule wont block

So I set up fail2ban on my Debian 7 server, still I've been getting hit a lot and I dont know why is not blocking properly. The regex works, it recognizes the attempts but it seems the iptables rules ...
0
votes
1answer
98 views

fail2ban doesnt permanently block

Fail2ban doesn't seem to block permanently. I have bantime =-1 but if i look a bit later on my iptables its just not there anymore all ill see is Chain fail2ban-ssh (1 references) target prot ...
0
votes
1answer
687 views

How to block Bad robots, spiders, crawlers and harvesters

I'm sick and tired of this bad robots, spiders, crawlers and harvesters. I have already configured my server to block IP connected for 5 minutes and with maxretry of 250 using fail2ban. But still some ...
0
votes
1answer
3k views

Fail2Ban can't insert iptables rule

It seems my fail2ban can't ban a host: 2013-06-22 18:18:24,546 fail2ban.actions.action: ERROR iptables -n -L INPUT | grep -q fail2ban-apache-noscript returned 100 2013-06-22 18:18:24,546 ...
0
votes
1answer
848 views

Anti-DDos Apache2 Fail2ban regex rule [duplicate]

I have fail2ban up and running, but my Failregex doesnt match anything, something is wrong. Request which i like to ban look like this: 186.6.65.199 - - [06/May/2013:18:46:21 +0400] "GET / HTTP/1.1" ...
0
votes
1answer
172 views

Remove wait time of fail2ban after logfile read

We all know that in fail2ban after reading one log file it will wait for 1 second.the problem is that during that waiting time the attacker make lots of attack. so how can we remove this waiting ...
0
votes
2answers
667 views

fail2ban statistics? [closed]

Is there a program that parses fail2ban.log and produces some statistics? Or should I set out and write something custom for our hosts? We run mostly Debian and fail2ban with iptables.
0
votes
1answer
2k views

Vsftpd: log failed login attempts

I am setting up fail2ban for various services. Ssh went smoothly, but I have had no success with vsftpd so far. The problem is, that I can't find a way to get failed login attempts to appear in the ...
0
votes
1answer
1k views

Fail2ban not configuring properly

I have just installed a fresh version of iptables followed by fail2ban, but fail2ban fails to do anything with iptables and I am stuck with no changes being made, this fail2ban not working properly. ...
0
votes
1answer
513 views

Have fail2ban client and server on different machines

I was wondering if it was possible to have fail2ban clients on different machines and have a server on one machine communicating with all the clients? Here's my situation: I have 4 servers and I'm ...
0
votes
0answers
16 views

Make Fail2ban parse latest logs generated monthly.

I have a log file generated monthly (e.g messageApril2015.log,messageMay2015.log). Can anyone tell me how to make fail2ban parse the latest log? I have read somewhere about adding %F%Y but it didn't ...
0
votes
0answers
16 views

Bad Referer AND DNS Cache Poisoning [duplicate]

I am annoyed by a lot of bad referer spammers I am seeing in apache's logs. 208.118.126.250 - - [12/May/2015:17:45:06 +0200] "GET /js/parsley.js HTTP/1.1" 200 91434 "http://voiceit.be/logins/login" ...
0
votes
0answers
34 views

Can't pass Fail2ban banned IP's to CloudFlare in Nginx?

I have Ubuntu 14.04, Nginx 1.6.2, MySQL 10.0.17-MariaDB, PHP 5.5.24 VPS. It running two WordPress sites. I use fail2ban with CSF. Fail2ban I use ban action as route, because iptables-multiport and ...
0
votes
1answer
98 views

ipTables IP Range will not be blocked

I have setup fail2ban with this Tutorial http://wireflare.com/permanently-ban-repeat-offenders-with-fail2ban/ and it seems working. But the attackers are changing their IPs and thats why I decided to ...
0
votes
0answers
19 views

How do I ban IP's that request files that do not exist using fail2ban? [duplicate]

I have recently started using Fail2Ban and need to configure a specific 'Jail'. My apache error logs are filled with requests for files within my /var/www folder. The folder doesn't contain any ...
0
votes
0answers
73 views

prevent phpbb bruteforcing with mod_security

Update: I edited this and added a fail2ban tag. Perhaps that might be another way to handle this issue. I'm running phpbb 3.0.13-PL1 and I would like to protect the login page from bruteforcing. I'm ...
0
votes
0answers
39 views

fail2ban WARNING invalid command on apache2 disabled websites

I have a problem on a Debian Squeezy webserver running fail2ban. Now and then, fail2ban stops working complaining of missing access.log: fail2ban.comm : WARNING Invalid command: ['set', ...
0
votes
1answer
404 views

Fail2ban doesn't start [closed]

I've done some changes to the file /etc/fail2ban/jail.local (a copy of /etc/fail2ban/jail.conf) and saved, but now fail2ban doesn't start. If I erase jail.local, then it start again. So the problem is ...
0
votes
1answer
154 views

Configuring varnish to write an apache error log with IP addresses

I am in the process of installing fail2ban on a webserver which runs Varnish. Many on the 'jails' require access to the apache/php error logs. One of the problems I have is that all of the refernces ...
0
votes
0answers
52 views

Fail2ban apache-myadmin regex

I've got a jail set up with the following regex, which I took from a standard filter file: apache-myadmin.conf failregex = ^[[]client <HOST>[]] File does not exist: *myadmin* *\s*$ ...
0
votes
1answer
217 views

Writing a fail2ban multiline regex

I've got some troublesome hosts trying it on with an SSH server I run, and I'm trying to ban them using fail2ban. Problem is, I haven't done much work with regexes, and even less with Python regexes. ...
0
votes
1answer
132 views

Fail2ban does not ban any ip-adresses with vsftpd

Fail2ban starts okey. It work with my sshd filter and bans IP-adresses as it should. But with vsftpd it does not register failed logins when I run: fail2ban-client status vsftpd I have tried both ...
0
votes
0answers
103 views

What does Nginx Proxy Filter in Fail2ban really do?

What does Nginx Proxy Filter in Fail2ban really do? I am currently setting up Fail2Ban for Nginx. Almost everywhere I've read, they all have included a setting for [nginx-proxy] proxy filter. From ...
0
votes
1answer
109 views

Brute force attacks with server's IP

I am running a Debian wheezy server with fail2ban installed, everything works as expected but recently my own server got banned. I added the server's IP in the exception row and it seems to work, but ...
0
votes
1answer
219 views

SecAst blocking IP's that fail2ban is not

I'm using SecAst on my Asterisk server as well as fail2ban. (Setup as an option as per the SecAst installation guide). I did this to test if SecAst is working right. I planned to remove fail2ban if ...
0
votes
0answers
312 views

Fail2Ban Apache-noscript failing to block script as referer

I am receiving a number of apache not found or unable to stat and would like to block these IP addresses using Fail2Ban. [Fri Feb 28 03:36:51.816955 2014] [:error] [pid 29027] [client ...
0
votes
1answer
1k views

Fail2ban won't start via /etc/init.d/fail2ban but will via /usr/bin/fail2ban-client

I've been running fail2ban successfully for a long time on RHEL. Now all of a sudden starting, stopping and restarting via /etc/init.d/fail2ban no longer works: # /etc/init.d/fail2ban start Starting ...