Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

0
votes
1answer
234 views

Loading fail2ban rules to iptables using iptables-persistent

I am using iptables-persistent package to reload my iptables on boot. And I have been thinking should I add the fail2ban rules to the loaded config file? Now I am seeing they are duplicated. This is ...
0
votes
1answer
100 views

Setup fail2ban with apf

Along with BFD we have recently installed fail2ban on our server, it is CentOS and it uses APF to block IPs. I have hunted online on how to get the two to work however when an IP is blocked by ...
0
votes
2answers
55 views

Massive blockingof ips done right

I run a website which is being abused every day with bots trying to send spam, not respecting robots.txt and so on. The biggest problem, however is repeating attempts to massively harvest website. ...
0
votes
1answer
100 views

Fail2Ban: I'm having trouble creating a regex for my Dovecot filter

I am trying to create a regex filter for my failed Dovecot entries in the maillog file. What I have created is: .*dovecot: auth: sql\(.*,<HOST>\): Password mismatch The target line in the ...
0
votes
1answer
151 views

How to configure fail2ban so it bans login attempts based on the structure of the attempted password or username

I want to set up two filters for fail2ban: If the user tries to login with a password that is less than 10 characters ban them. And if the user tries to login with a password that is more than 10 ...
0
votes
2answers
3k views

fail2ban apache-noscript not working

My debian server has come under attack recently and I've been poring over the logs to see what I can do to harden it. I've been running fail2ban for a while but I've noticed the apache-noscript jail ...
0
votes
1answer
1k views

Fail2Ban adds iptable rules but they are not working?

Fail2Ban just blocked my IP for 3 SSH attempts. It added the iptables rule and I can see it using the "sudo iptables -L -n" command. But I can still access the site and login through SSH! What might ...
0
votes
1answer
2k views

Vsftpd: log failed login attempts

I am setting up fail2ban for various services. Ssh went smoothly, but I have had no success with vsftpd so far. The problem is, that I can't find a way to get failed login attempts to appear in the ...
0
votes
2answers
359 views

SSH Authentication - Bruteforce attack prevention

I use certificate/key based ssh authentication with sshd running on non standard port. Do I still need to install denyhosts/fail2ban or log analysis based detection?. Do I get any advantage?
0
votes
1answer
1k views

fail2ban settings for apache

Basically at the moment our server is set a little too secure and fail2ban is banning users who are just browsing the website even if there is just a missing image for example. Which of the ...
0
votes
2answers
658 views

fail2ban regex to catch dovecot log entry?

Am trying to write a fail2ban regex that catches anyone who tries the user-id "administrador". For example, this log entry: Jan 2 09:55:01 mail2 dovecot: pop3-login: Disconnected: ...
0
votes
1answer
3k views

Configure Fail2ban to ignore local (NAT) IPs

How can I configure fail2ban to always allow attempts from the local/NAT ips (ie 192.168.1.*). I have tried putting the following entry into /etc/fail2ban/jail.conf: [DEFAULT] # "ignoreip" can be ...
0
votes
1answer
18 views

fail2ban config failregex for Tomcat 8 [closed]

The current fail2ban version 0.9.1 does not have a pre-configured filter for Tomcat. In case anyone needs it, here is a regex that works for me. Note that my application is not expected to have any ...
0
votes
1answer
45 views

journalctl: Cannot filter ownCloud log lines, fail2ban will not ban

Using a general journalctl command, the log line of interest appears: [root@bee server]# journalctl -n -- Logs begin at Mon 2015-01-26 19:44:33 EET, end at Wed 2015-06-10 21:41:12 EEST. -- ... Jun 10 ...
0
votes
1answer
80 views

fail2ban keeps trying to ban again

I have an issue getting fail2ban to do what I want. I use a action which bans the IP on CLoudFlare, that means that still a lot of requests get through until everything has been updated on ...
0
votes
1answer
114 views

Can't connect to Ubuntu VPS via SSH,SFTP

When I try to login to my VPS using SSH and SFTP it's not connect to the server. Then I power off and power on the VPS by the VPS provider control panel (digital ocean). Once it boot up, first few ...
0
votes
1answer
35 views

Cannot understand this example fail2ban rule

I'm trying to secure my admin and user login page from brute force attacks. I have setup iptables and the closest thing I can find which looks useful is this: jail file: [nginx-login] enabled = true ...
0
votes
1answer
147 views

Fail2ban not working on Ubuntu 12.04

I'm trying to implement fail2ban on a Ubuntu 12.04 x64 server. I've done the following: apt-get install fail2ban Made a copy of jail.conf in /etc/fail2ban/jail.conf.local here's an excerpt: ...
0
votes
1answer
630 views

Fail2Ban - Iptables - Set does not exist

I have a very strange problem with fail2ban/iptables. Something is not working right, but I can't figoure out what. I have added this conf & and filter for fail2ban: [wordpress-register] enabled ...
0
votes
1answer
117 views

Logging 403 Rewrites for Brute Force Attacks

As explained in Wordpress Codec, I want to prevent brute force attacks for wp-login.php via RewritetRule. http://codex.wordpress.org/Brute_Force_Attacks#Deny_Access_to_No_Referrer_Requests Rather ...
0
votes
1answer
170 views

fail2ban block ports rules iptable

I just installed Ubuntu Server 14.04 and don't have much experience with IPtables. I am trying to get a basic setup going where I only accept SSH connections on port 22 and 2222. I actually have that ...
0
votes
1answer
121 views

SELinux problems running Expect script from fail2ban

I have an Expect script that works fine if I run it manually, but fails when run as an action from Fail2ban. The error message is as follows: spawn /usr/bin/telnet 192.168.242.1 The system has no ...
0
votes
1answer
1k views

fail2ban not working on apache Ubuntu

Nothing happens even though it detects in the logs. It does not block the IP. It works fine forVSFTP but not for apache. Please help. You can see the config and log below. jail.local config file: ...
0
votes
2answers
332 views

Fail2Ban Regex - Joomla / PHP5-FPM

i can't get a regex for fail2ban to work. I want to match the following: [Tue Jun 24 10:22:14.528987 2014] [fcgid:warn] [pid 22526:tid 139757615011584] [client IP:PORT] mod_fcgid: stderr: user admin ...
0
votes
1answer
520 views

fail2ban not banning, time is off, how do I sync them?

In searching for why fail2ban is not banning patterns, I found that when I run /etc/init.d/fail2ban status it reports over an hour behind my 'date' command. 'date' says its: Tue Mar 18 20:45:02 MST ...
0
votes
1answer
2k views

Postfix fail2ban help.. I have a bad host but fail2ban won't block him

Hi I am using postfix plus fail2ban on Centos 6.5 but I am getting botted (I am not relaying but there you go) and for some reason fail2ban isn't able to cut the ip and block it this is 6/7 times a ...
0
votes
3answers
1k views

fail2ban error about python?

I have just installed fail2ban on my debian7 machine but whenever i start it i get a lot of error which seems to be about python? [....] Restarting authentication failure monitor: fail2banTraceback ...
0
votes
1answer
571 views

Point fail2ban to new log, without losing current bans?

I have logs in /var/log/syslog/YYYY-MM-DD/file.log files. New directories are created automatically by rsyslog, and logs are automatically put to new locations. Every day, I archive previous day of ...
0
votes
1answer
386 views

How to unban from fail2ban?

fail2ban banned my ip for SSH. In email I received that said I got banned via fail2ban after 5 attempts against SSH. Which is not even truth i wasn't even loging to SSH. I can still access webmin. I ...
0
votes
1answer
216 views

fail2ban iptable rule wont block

So I set up fail2ban on my Debian 7 server, still I've been getting hit a lot and I dont know why is not blocking properly. The regex works, it recognizes the attempts but it seems the iptables rules ...
0
votes
1answer
106 views

fail2ban doesnt permanently block

Fail2ban doesn't seem to block permanently. I have bantime =-1 but if i look a bit later on my iptables its just not there anymore all ill see is Chain fail2ban-ssh (1 references) target prot ...
0
votes
1answer
760 views

How to block Bad robots, spiders, crawlers and harvesters

I'm sick and tired of this bad robots, spiders, crawlers and harvesters. I have already configured my server to block IP connected for 5 minutes and with maxretry of 250 using fail2ban. But still some ...
0
votes
1answer
3k views

Fail2Ban can't insert iptables rule

It seems my fail2ban can't ban a host: 2013-06-22 18:18:24,546 fail2ban.actions.action: ERROR iptables -n -L INPUT | grep -q fail2ban-apache-noscript returned 100 2013-06-22 18:18:24,546 ...
0
votes
1answer
914 views

Anti-DDos Apache2 Fail2ban regex rule [duplicate]

I have fail2ban up and running, but my Failregex doesnt match anything, something is wrong. Request which i like to ban look like this: 186.6.65.199 - - [06/May/2013:18:46:21 +0400] "GET / HTTP/1.1" ...
0
votes
1answer
180 views

Remove wait time of fail2ban after logfile read

We all know that in fail2ban after reading one log file it will wait for 1 second.the problem is that during that waiting time the attacker make lots of attack. so how can we remove this waiting ...
0
votes
2answers
708 views

fail2ban statistics? [closed]

Is there a program that parses fail2ban.log and produces some statistics? Or should I set out and write something custom for our hosts? We run mostly Debian and fail2ban with iptables.
0
votes
1answer
1k views

Fail2ban not configuring properly

I have just installed a fresh version of iptables followed by fail2ban, but fail2ban fails to do anything with iptables and I am stuck with no changes being made, this fail2ban not working properly. ...
0
votes
1answer
546 views

Have fail2ban client and server on different machines

I was wondering if it was possible to have fail2ban clients on different machines and have a server on one machine communicating with all the clients? Here's my situation: I have 4 servers and I'm ...
0
votes
0answers
5 views

fail2ban couriertcpd: LOGIN FAILED not banning

My fail2ban is not banning as I expect. An example of my log entries are :- Jul 26 07:11:29 mail couriertcpd: LOGIN FAILED, user=sally, ip=[::ffff:54.191.110.169] Jul 26 07:13:22 mail couriertcpd: ...
0
votes
0answers
58 views

Trouble figuring out a fail2ban log error message: “iptables -n -L INPUT | grep -q 'fail2ban-SSH[ \t]' returned 100”

Here is my jail.local rule for ssh: [ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] logpath = /var/log/messages maxretry = 5 Here is what my ...
0
votes
0answers
41 views

fail2ban wont ban ssh from local hosts

I'm trying to configure fail2ban to block ssh from a local hosts. Fail2ban is install on CentOS 7 with firewall (Linux 3.10.0-229.4.2.el7.x86_64 x86_64 ). I have copied the jail.conf to jail.local i ...
0
votes
0answers
23 views

Fail2ban not unbanning ip from jail

I've tried finding a way to unban an IP from fail2ban, but no matter what I do it seems to stay banned. I recently ran fail2ban-client get ssh actionunban myip and I do not get an error message, but ...
0
votes
0answers
21 views

fail2ban stops logging after some time (3-4 days)

I've noticed that whenever I want to see fail2ban logs after 3 or 4 days of being working, it compresses the logs to .gz which Im fine with that: -rw-r--r--. 1 root root 90034 May 1 12:49 ...
0
votes
0answers
27 views

Make Fail2ban parse latest logs generated monthly.

I have a log file generated monthly (e.g messageApril2015.log,messageMay2015.log). Can anyone tell me how to make fail2ban parse the latest log? I have read somewhere about adding %F%Y but it didn't ...
0
votes
0answers
16 views

Bad Referer AND DNS Cache Poisoning [duplicate]

I am annoyed by a lot of bad referer spammers I am seeing in apache's logs. 208.118.126.250 - - [12/May/2015:17:45:06 +0200] "GET /js/parsley.js HTTP/1.1" 200 91434 "http://voiceit.be/logins/login" ...
0
votes
0answers
93 views

Can't pass Fail2ban banned IP's to CloudFlare in Nginx?

I have Ubuntu 14.04, Nginx 1.6.2, MySQL 10.0.17-MariaDB, PHP 5.5.24 VPS. It running two WordPress sites. I use fail2ban with CSF. Fail2ban I use ban action as route, because iptables-multiport and ...
0
votes
1answer
150 views

ipTables IP Range will not be blocked

I have setup fail2ban with this Tutorial http://wireflare.com/permanently-ban-repeat-offenders-with-fail2ban/ and it seems working. But the attackers are changing their IPs and thats why I decided to ...
0
votes
0answers
20 views

How do I ban IP's that request files that do not exist using fail2ban? [duplicate]

I have recently started using Fail2Ban and need to configure a specific 'Jail'. My apache error logs are filled with requests for files within my /var/www folder. The folder doesn't contain any ...
0
votes
0answers
109 views

prevent phpbb bruteforcing with mod_security

Update: I edited this and added a fail2ban tag. Perhaps that might be another way to handle this issue. I'm running phpbb 3.0.13-PL1 and I would like to protect the login page from bruteforcing. I'm ...
0
votes
0answers
54 views

fail2ban WARNING invalid command on apache2 disabled websites

I have a problem on a Debian Squeezy webserver running fail2ban. Now and then, fail2ban stops working complaining of missing access.log: fail2ban.comm : WARNING Invalid command: ['set', ...