Questions tagged [fail2ban]

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

Filter by
Sorted by
Tagged with
1 vote
2 answers
2k views

Brute Force attack in DirectAdmin

I have problem with brute force monitor in direct admin. Every minute i get info like this: 15705610210001 52.187.17.107 123 1 sshd4 Oct 8 20:56:24 server sshd[10817]: Failed password for ...
1 vote
1 answer
3k views

Banning IP on 404 requests using fail2ban not working

Server: Ubuntu 16.04/Nginx Scenario: I'm trying to ban IP's based on multiple 404 requests on my server. I've created a filter in /etc/fail2ban/filter.d/banbadrequest.conf [definition] failregex = ...
1 vote
1 answer
2k views

Fail2Ban - IP Tables REJECT not banning

I have fail2ban running on Ubuntu 16, with a few jails running. One is http-get-dos: Within jail.conf [http-get-dos] enabled = true port = http,https filter = http-get-dos logpath = /var/log/...
0 votes
1 answer
127 views

Is it possible to whitelist a specific IP that belongs to a banned network?

I need to whitelist a specific IP that belongs to a fail2ban banned network. Does ignoreip option works in this case? How can I solve otherwise? I've to manage directly with iptables for this IP? ...
-1 votes
1 answer
900 views

After setting up fail2ban w/Permanently Ban Repeat Offenders to fail2ban - I'm not be getting any emails of bans w/detailed info anymore

After installing fail2ban 0.9.3 on my uBuntu server 16.04 and then following the steps located from this link - Perma Ban Repeat Offenders I did service fail2ban reload and got the emails showing the ...
3 votes
1 answer
4k views

Fail2Ban Filter Errors

I'm trying to add two fail2ban filters, one for post flood and phpmyadmin brute force but i get the following errors. logs: fail2ban.filter : ERROR No 'host' group in '[[]client []] File does not ...
0 votes
2 answers
2k views

Stopping SSH brute force from China - fail2ban not working

I see things like this in my /var/log/auth.log sshd[2173]: Unable to negotiate with 218.92.0.205 port 21029: no matching host key type found. Their offer: ssh-rsa,ssh-dss [preauth] sshd[1964]: ...
0 votes
1 answer
446 views

Change the input number of fail2ban rules for iptables

I would like to change the Input number of the fail2ban rule in iptables to not be on the top (no.1) just to be added after all other rules. (after removing the rule it gets back every time). Image:
6 votes
2 answers
4k views

How to blacklist or whitelist lots or few ip ranges with ipset and iptables + fail2ban

EDIT: It's astonishing how the urge to find a solution sometimes is sufficient to slowly but steadily lead one towards a solution. Also, the more often I reread my question in order to clarify it, I ...
0 votes
2 answers
1k views

Is it wise to have fail2ban block 301 brute forces when you have http to https redirection enabled?

Recently my servers started getting bombarded by anonymous scanners/brute forces. This is how my nginx access.log looked like after the attacks : xxx.xxx.xxx.xxx - - [07/Sep/2019:23:30:16 +0200] "...
1 vote
2 answers
2k views

Fail2Ban-client works while its service fails

On CentOS7 I have the fail2ban-client working flawlessly, as it bans ips on failed logins as configured, but when I look at its systemctl status it shows as if it wouldn't be active or in failed state ...
1 vote
1 answer
513 views

Drop packets with iptables for ssh login by user root

Is it possible to have iptables DROP any packets with user "root" so that the SSH daemon doesn't even have to waste cycles denying the login attempt? I already deny root login attempts in my ...
3 votes
2 answers
2k views

fail2ban on server with LXC Containers

The issue is modprobe and iptables don't work inside an LXC Container. LXC is the userspace control package for Linux Containers, a lightweight virtual system mechanism sometimes described as “...
1 vote
1 answer
812 views

Cloudflare behind site iptables not blocking HTTP and HTTPS ports

When the Fail2ban trigger an IP ban action, I want to block all the ports on my Ubuntu Server. Right now, I use banaction = iptables-allports and CSF. At this moment it only blocked SSH port, even if ...
0 votes
0 answers
584 views

Fail2ban and Joomla CMS Regex

These are my configurations in /etc/fail2ban: ** jail.local** [joomla-login-errors] enabled = true port = http,https filter = joomla-login-errors logpath = /var/www/path-to-website/logs/error.php ...
48 votes
6 answers
87k views

Permanent block of IP after n retries using fail2ban

I have a fail2ban configured like below: block the ip after 3 failed attempts release the IP after 300 sec timeout This works perfectly and I want to keep it this way such that a valid user gets a ...
0 votes
1 answer
1k views

Fail2ban unable to write iptables rules

Working on Centos 6.3 ,fail2ban version 0.9.6, fail2ban is unable to write in iptables rules after start and nothing relating to f2b chain seen in iptables -L, I have configured it on local VM and it ...
0 votes
2 answers
2k views

Strange behavior with fail2ban when permanently banning IPs

As per documentation, setting jail bantime to a negative value should result in a permanent ban. However once that is done, the following behavior changes, compared to when setting bantime to a ...
1 vote
1 answer
4k views

fail2ban cannot set iptables rules

I have only a thin knowledge of both iptables and fail2ban, but my mail server has a lot of incoming connections that I want to get rid of. I have this config block in /etc/fail2ban/jail.conf [...
-2 votes
1 answer
392 views

Fail2ban won't ban IPs

I installed the Fail2ban on my Ubuntu 18 server with etc/fail2ban/jail.local file [sshd] enabled = true port = 22 filter = sshd logpath = /var/log/fail2ssh.log maxretry = 2 after restart fail2ban ...
0 votes
1 answer
263 views

fail2ban filter for ical regex

i am trying to get a regex for an ical service on my host working without success. This is a part of the logfile: Tue Jul 23 13:55:23 2019: ical|T720] [info ] Accepted connection from [::ffff:2.3.4....
0 votes
0 answers
788 views

questions about fail2Ban,ipset and iptables

I have set up fail2ban on ubuntu Linux web server 16.04 lts. I have set it up so that the denied ip (jailed) is always remembered and the same for the iptable - it is set up to remember the denied ...
1 vote
1 answer
4k views

Fail2Ban, how should the datepattern for this entry look like

I've got following entry in my logfile for gitlab (application.log): June 10, 2019 19:04: Failed Login: username=Zzzz ip=XXX.XXX.XXX.XXX How should the datepattern for my Fail2Ban-filter look like?...
1 vote
1 answer
1k views

Fail2ban ban is not working as expected [DDOS]

I have this jail: ##To stop DOS attack from remote host. [http-get-dos] enabled = true port = http,https filter = http-get-dos logpath = /usr/local/nginx/localhost-access.log maxretry = 100 findtime ...
1 vote
1 answer
1k views

Fail2ban: Ban ip on all ports exept HTTP[S] (or group of ports)

My server currrently has very strict fail2ban rules, which permanently and persistently ban any ip that fails to login once on all ports. This might seem overkill, but most ports are "private" ports (...
0 votes
2 answers
2k views

UFW is blocking mailserver traffic (dovecot, postfix, MariaDB, Rspamd)

As described in the title, I am running a dovecot/postfix/Rspamd Mailservercombo with a MariaDB behind it. I noticed how, in the last days, I couldn't receive/send any mail from my e-mail clients ...
0 votes
1 answer
969 views

fail2ban ignored daily log files

I'm using fail2ban to detect and ban irregular users. This works more or less well, but has one issue with Exim which writes daily log files on my system: The new log file of the next day is simply ...
2 votes
1 answer
2k views

Fail2Ban adds iptable rules but they are not working?

Fail2Ban just blocked my IP for 3 SSH attempts. It added the iptables rule and I can see it using the "sudo iptables -L -n" command. But I can still access the site and login through SSH! What might ...
1 vote
1 answer
1k views

Fail2ban bans IP, but not until it already has hundreds of requests

I have a jail that picks up on a specific user agent. It eventually bans it, but it still gets by with several hundred requests. Here is the relevant info (unless anything else is needed): Ban ...
0 votes
0 answers
444 views

How to prevent or reduce spikes in Apache load caused by bots

Today MySQL was killed off by the oom-killer on one of our shared web servers, which caused an outage for our customers. When I investigated what happened I found there were over 1,300 requests in the ...
0 votes
2 answers
4k views

Fail2ban blocking IP after unban

I cant unban an IP from the server. I removed the address from fail2ban and deleted the entry from iptables, but I still can't login. My Jail list name is sshd (checked with fail2ban-client status) ...
4 votes
2 answers
11k views

fail2ban cannot ban ip on all ports if it's already banned for specific port

I'm using a custom filter in fail2ban to search through it's own log and ban an ip after 5 bans from any of the regular filters. I'm using iptables-allports as action for this. All other filters are ...
0 votes
1 answer
74 views

fail2ban filter not matching - is it regex or something else

I have a website with a php script that is allowed to be called infrequently. Some annoying users are hitting my script every few seconds and I need to ban them. I have setup failban but they are ...
3 votes
1 answer
3k views

ufw enable is not working, and it crashes my OS

Where the problems started: First i tried to install fail2ban from the ISPmanager UI, the fail2ban was installed but i got a error related to the package coremanager-pkg-fail2ban, and the fail2ban ...
0 votes
1 answer
1k views

fail2ban ban GET get.php requests with status code 200

So i am newbie about all this. This is how log looks: 213.135.179.254 - - [27/Apr/2017:17:39:06 +0200] "GET /get.php?username=1515&password=1515&type=m3u HTTP/1.1" 200 0 "-" "-" 213.135.179....
0 votes
1 answer
560 views

How to make fail2ban block access to webpage on specific port [closed]

I am trying to deny access to all IPs except my own IP address. I think I could do this using Nginx log file, and create a filter and rule in fail2ban. However, this specific page is on a port like ...
0 votes
1 answer
3k views

fail2ban not correctly modifying the iptables effectively?

I just installed fail2ban in NetinVM (a constellation of virtual machines inside a VM) so far so good, I install in a specific machine (10.5.1.13) where ssh is on 2222 (all on root) From other ...
0 votes
1 answer
284 views

Fail2ban bot search failregex mismatch error log format

I want to ban the following type bot search. But the default nginx-botsearch.conf not matching this error log. 2019/04/19 12:42:22 [error] 1193#1193: *6 open() "/var/www/domain.com/htdocs/.well-...
2 votes
0 answers
400 views

fail2ban expired bans not removed from iptables

I have recently installed fail2ban on Ubuntu 16, and it's working in that bans/assignments to jails is working correctly, but once the jail assignment expires, the banned IP remains in iptables as ...
0 votes
1 answer
2k views

fail2ban-regex <HOST> filter missed

quick question regarding fail2ban filter regex problem I have a log pattern: 2018-02-06 07:40:20,954 fail2ban.actions [26058]: NOTICE [postfix-sasl] Ban 192.168.2.14 I try to Ban IP (192.168.2.14) ...
1 vote
1 answer
417 views

How to preserve external IPs through gateway to keep using Fail2Ban

I have a CentOS 7 box with 2 NICs acting as a gateway; one NIC is connected to the internet while the other NIC is connected to our LAN. The first NIC belongs to the 'external' zone of firewalld, it ...
0 votes
0 answers
1k views

fail2ban.ipdns: Unable to find a corresponding IP address for unknown [Errno -2]

Was just scanning through my Fail2ban logs on a routine security check. Found the following line occurring a few times over the last 4 days. Should I be concerned? I Googled, but I couldn't find ...
2 votes
2 answers
5k views

Fail2Ban and modsecurity not working

so due some spamming attacks and stuff I decided to enable modsecurity on my webserver. I installed Fail2Ban and configured it like that: excerpt from jail.local: # # Custom modsecurity # [modsec] ...
1 vote
1 answer
14k views

Fail2Ban Not starting when using sudo systemctl status fail2ban.service

When i try and restart fail2ban using sudo service fail2ban restart it displays the following error from systemctl status fail2ban.service Apr 02 20:12:30 centos systemd[1]: fail2ban.service: control ...
0 votes
1 answer
3k views

fail2ban logs full of "Failed to execute ban jail 'recidive' action 'iptables-multiport'"

I've a ton of errors like this in my fail2ban.log fail2ban.actions [13370]: ERROR Failed to execute ban jail 'recidive' action 'iptables-multiport' info 'CallingMap({'ip': '164.132.49.140', '...
1 vote
0 answers
228 views

fail2ban config to block attacks on magento payflow endpoint

This is regarding the stopping DDoS attack on Magento payment gateway reported here: https://support.magento.com/hc/en-us/articles/360025515991-PayPal-Payflow-Pro-active-carding-activity I am trying ...
0 votes
1 answer
223 views

ModSecurity and CIDR notation to block multiple IPs at the same time

I use ModSecurity and Fail2Ban on Apache2.4 Often times I get a mischievous hit on the server that tries to do something bad. No problem, Modsecurity and Fail2Ban catches it and bans THAT IP. For ...
0 votes
1 answer
340 views

Can I fake an IP in a ftp test?

Recently I receive an message from my ISP mentioning: "We have detected abuse from the IP address" This message was send to us because a fail2ban application in some part of the world send an ...
0 votes
0 answers
66 views

Fail2ban incorrectly banning matched IP

I have a very simple filter that does the following: [nginx-node] failregex = ^<HOST> -.*(socket.io).* I can see that there are clear matches: grep 'socket.io' /var/log/nginx/example.com....
0 votes
1 answer
1k views

Block Remote Code Execution Ubuntu Server Fail2Ban & Cloudflare

Recently I figured out, that my Ubuntu (LEMP) server became a target for remote code execution attacks. In terms of access.log files it could looks like: 183.82.248.85 - - [06/Mar/2019:19:12:21 +...

1
5 6
7
8 9
15