Questions tagged [fail2ban]

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

Filter by
Sorted by
Tagged with
0 votes
0 answers
16 views

Correct regex to block POST request and GET request to single file in apache?

What's the correct fail2ban regex to block these kind of requests? The excerpt is from apache access.log 181.204.83.115 - - [28/Mar/2024:17:38:47 +0200] "POST /login.php HTTP/1.1" 200 11593 ...
0 votes
0 answers
20 views

fail2ban for dovecot not working

i have set up ufw in linux mint and works fine. in my linux mint box i run dovecot and i see many failure login tries. I set up fail2ban like this: [dovecot-pop3imap] enabled = true filter = dovecot-...
3 votes
3 answers
1k views

fail2ban bans IP addresses, yet they still appear in access.log

This is my filter: [Definition] failregex = <HOST> .* "POST /customer/account/create.*$ <HOST> .* "GET /customer/account/create.*$ and this the corresponding jail: [...
-1 votes
1 answer
78 views

fail2ban cannot block ip public, it works only for private ip

My server live behind the reverse proxy nginx, but the ip of the client access shows in the apache log like this, looks normal, there is no x-forward things in the log. 103.221.234.206 - - [28/Feb/...
304 votes
17 answers
735k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
2 votes
1 answer
7k views

How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?

Fail2Ban on Ubuntu 10.04 Configuration files /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1 bantime = 10 # made for test purposes maxretry = 3 backend = polling destemail = email@...
0 votes
1 answer
58 views

Fail2Ban RegEx works but filter does not

my plan is to ban all accesses to my webserver which repeatedly produce 404-errors and obviously do some scanning only For this I tried fail2ban-regex /var/log/apache2/otheraccess.log '^<HOST>. -...
0 votes
2 answers
5k views

Debian with iptables and fail2ban not ban IP

I have server with Debian 9. I have installed fail2ban and configured it. It work with sshd (ban IP on failed logins) but i can't make it work with apache-auth (IP is ban but iptables don't block it). ...
0 votes
1 answer
5k views

How can I have fail2ban log to an external syslog server?

I'm running an Ubuntu 16.04 web server (running Webmin). I also have Graylog running on a separate server on my LAN. I'd like to have fail2ban log itself to /var/log/fail2ban.log as well as my ...
2 votes
3 answers
14k views

Fail2ban MTA=Postfix Setting in Jail Config giving Error

In /etc/fail2ban/jail.local, when I have the MTA setting to Postfix, Fail2Ban is showing an error and is unable to start. [DEFAULT] ignoreip = 127.0.0.1/8 bantime = 1800 ...
0 votes
1 answer
194 views

Trying to understand if fail2ban is working on Debian 10 VPS

I have a Debian 10 server running on a VPS. The only software I installed is: tinyproxy (http proxy) and fail2ban I have included the results of port scan using nmap I have included my specific ...
0 votes
2 answers
132 views

Fail2Ban: RegEx to filter all 404 errors out of the Apache-log

In my logs I regularly see loads of 404-errors where bots obviously do scan the server systematically for specific software installations. As this also causes loads of traffic, I want to ban them. So ...
0 votes
1 answer
218 views

fail2ban include list of ip addresses to ban

Suppose I have a .txt file containing a list of ip addresses I'd like to ban for some amount of time (so, a blacklist file of some sort). I know how do do this in Apache (for example) - simply by ...
1 vote
0 answers
92 views

firewalld and iptables | fail2ban

I have fail2ban 1.0.2 running on an Almalinux server. Seems to be working as hoped, but I'm puzzled by something. have sshd.local and 00-firewalld.local in jail.d (installed fail2ban and fail2ban-...
1 vote
0 answers
33 views

iptables ignores REJECT in custom chain but works in the main chain

I configured a server with fail2ban for the smtp server. Now, fail2ban correctly bans the IPs and I can see them in the iptables chain of fail2ban. However, the kernel seems to ignore the iptables ...
0 votes
1 answer
122 views

fail2ban | difference between [sshd] in jail.local, vs sshd.local in jail.d?

AlmaLinux server -- 1.0.2 fail2ban installed. Seems to be working, but, am hoping someone can clarify something for me: 1\ working with jail.local copy of jail.conf. In said jail.local, there is a ...
0 votes
1 answer
58 views

Is firewalld needed by fail2ban?

When I install fail2ban, it also installs firewalld. After a reboot, firewalld also starts, enforcing settings on the iptables (dropping most connections accept ssh). This is frustrating as I want to ...
-1 votes
1 answer
79 views

fail2ban Jail starts but no connections are showed

I installed fail2ban on my Ubuntu server. It seems to starts fine: cat fail2ban.log 2023-12-07 14:55:27,758 fail2ban.server [803]: INFO -------------------------------------------------- ...
1 vote
1 answer
978 views

Issue with sshd logfile using fail2ban on minimal Ubuntu server 22.04

I am working on trying to get fail2ban set up and enabled for sshd on my VPS with Ionos. I am using a minimal Ubuntu 22.04 server install. fail2ban has installed fine, but getting it to run seems a ...
1 vote
1 answer
112 views

fail2ban ignores <HOST> IP address and bans all incoming traffic

I'm trying to enable fail2ban on Centos 7 with Apache. I have an app which writes to the error log a specific string when login fails. responds with the right IP address in the Banned IP list, > ...
0 votes
0 answers
104 views

fail2ban jail is not respected

I'm completely new to fail2ban. I implemented a custom filter and a custom jail to ban some users from accessing my website which is hosted by apache. Fail2ban seems to recognize my regex fail rules ...
0 votes
0 answers
56 views

fail2ban missed lines in my filter

I am completely new to using fail2ban. Right now I am getting a missed line error but I cannot figure out why. I have the following two files: // /etc/fail2ban/filter.d/apache-custom.conf [...
-1 votes
1 answer
289 views

Crafting regex for Fail2ban and NGINX

I'm having some trouble understanding how to craft a regex to capture probe attempts on my nginx webserver. I would like to craft a filter to catch sites hitting certain files (by name) and/or by php ...
0 votes
0 answers
67 views

Fail2ban rule not working, nginx basic auth

I have a regexp like this that is used in my fail2ban jail ^ \[error\] \d+#\d+: \*\d+ user "\S+":? (password mismatch|was not found in ".*"), client: <HOST>, server: \S+, ...
0 votes
0 answers
216 views

How to correctly remove entries from firewalld ipset runtime?

Running Debian 12 I have created an IPSet in the following manner: ~$ firewall-cmd --permanent --new-ipset=myipset --type=hash:ip --option=timeout=0 success ~$ firewall-cmd --reload success ~$ ...
0 votes
1 answer
85 views

Retrieve URL / Request in a fail2ban action with nginx

I have configured fail2ban to block spam attempts with nginx. everything works but I would like to be able to retrieve the url / domain visited in my actions. recovering the “logpath” also suits me ...
2 votes
2 answers
1k views

fail2ban txt list creation of banned IP

using fail2ban for years, working nice, would like to automate and harden the security for my router. So I would like that fail2ban created a local file, example, list.txt file with a list of banned ...
0 votes
1 answer
126 views

Banning an IP address (or subnet) on Debian (still connecting after ufw and iptables)

I know the subject of banning IP addresses have been covered multiple times but for some reason I'm failing to address/identify this one. I am trying to identify a problem with random attacks of some ...
0 votes
1 answer
181 views

Unable to configure fail2ban to protect samba shares

With this configuration service (fail2ban) starts, logfile register wrong attempts, but still not count attempts in fail2ban-client. I suspect that there is a problem with regex, but this is the only ...
0 votes
2 answers
7k views

Use fail2ban for Samba

I'm looking for a way to use fail2ban to control/block samba logins on Ubuntu 12.04.3 LTS. I already set up an jail.local. The samba part currently looks like this: [samba] enabled = true port = 135,...
1 vote
2 answers
3k views

Configure Fail2ban for SSH and ldap

I have a fail2ban Installation on two Centos7 machines, and I want to secure SSH with it (The SSH protecting seems active), set the allowed pw-fails to 5, and left the banntime at 3600 secs. I tried ...
1 vote
1 answer
3k views

Creating a custom filter for fail2ban

I'm trying to create a custom jail and filter in fail2ban for motion stream http authentication. The log directory is /var/log/motion/motion.log and a failed login attempt generates: [0:ml1] [ALR] [...
0 votes
1 answer
129 views

Creating an IPTABLES chain, whose rules are ignored, unless the packet is from a certain port?

I want to confirm the following. If I create a chain whose first rule is: iptables -I INPUT -p tcp -m multiport --dports 25,465 -j name Does that mean that any further specified rules in the chain, ...
5 votes
3 answers
8k views

What is a good way to detect DoS and DDoS in Fail2Ban?

I am configuring Fail2Ban on my Ubuntu web server to prevent it from being a victim of DoS / DDoS. I don't want to use Cloudflare because I have to route my DNS over and use their SSl cert. ...
0 votes
2 answers
346 views

fail2ban on host for rootless podman keycloak container

running on Rocky Linux 9.2 with podman 4.4.1. I got a podman Pod with keycloak + postgresql inside, running rootless. The pod itself with --network 'slirp4netns:port_handler=slirp4netns'. The keycloak ...
0 votes
1 answer
272 views

Fail2ban accepted the customized jail but it did not detect the event

this problem drives me crazy. I configured a jail to prevent excessive http post to my web server. Seems the fail2ban server accepts my new jail but nothing takes effective in the fail2ban server. ...
0 votes
1 answer
95 views

iptables string matching feasability; possible use with fail2ban

We have several Apache 2.4 web servers behind a load balancer and CDN front end - where HTTPS is terminated - we see the client IP in headers from the front end in the back end Apache logs. I'm ...
0 votes
3 answers
1k views

fail2ban and ssh don't work

I have configured ssh with port 2122 and pubkey only. I secured but i want more banning the lamers wich try bruteforce auth. My configuration of fail2ban jail.local [INCLUDES] before = paths-...
121 votes
15 answers
533k views

How to show all banned IP with fail2ban?

When I run this command fail2ban-client status sshd I got this: Status for the jail: sshd |- Filter | |- Currently failed: 1 | |- Total failed: 81 | `- File list: /var/log/auth.log `- ...
0 votes
1 answer
438 views

Fail2ban apache2 access log regex

Can anyone help me with fail2ban regex My goal is to ban any accessing .env or .php files or any request that starts with "wp-", it is a little bit confusing and another to detect invalid ...
0 votes
2 answers
267 views

Apache Log files Fail2ban and WordPress

I am trying to get Fail2ban to block brute force and persistent xmlrpc and wp-login attacks on a WordPress site. I have an issue with the apache logging filenames. Getting past selinux issues was ...
0 votes
1 answer
96 views

fail2ban is working but not getting email to show that sshd-ddos is running

I have fail2ban running on my server and I have three programs running: sshd, sshd-ddos and runcloud-agent. There are no error messages but when I recently restarted my server, I got an email message ...
32 votes
5 answers
21k views

fail2ban's database is too large (over 500mb). How do I get it to a reasonable size?

Recently my backups have started failing, and I tracked the problem to the file /var/lib/fail2ban/fail2ban.sqlite3. It is over 500mb. I am not sure whether it has been growing over time or if this is ...
1 vote
1 answer
643 views

fail2ban ssh not banning any IP

I started fail2ban service as sudo systemctl restart fail2ban.service, it successfully started. But my ssh attempts with the wrong password from remote PCs are not blocking, There is no IP listed in ...
1 vote
2 answers
4k views

Fail2Ban not banning, Regex shows many fails in logs

I have the following jail defined in my /etc/fail2ban/jail.conf. For privacy/security I've replaced references to IPs with local 10.0.0.x addresses. [ssh-iptables] enabled = true filter = sshd ...
0 votes
1 answer
68 views

Does iptables apply all rules in order when an incoming connection is received?

I'm using iptables and fail2ban to secure server connections. Currently I have connections filtered via a router passing only ports for email and webserver access and fail2ban adding restrictions ...
0 votes
2 answers
186 views

Unable to compile regular expression in Fail2Ban

I'm trying to get this regex working in Fail2Ban: SRC=(?<ADDR>.*) DST.*(?=DPT=5003) In a regex tester it's working very fine. When testing in Fail2Ban, I get this error: ERROR: Unable to ...
0 votes
1 answer
139 views

Using fail2ban to scan for SSH Accepted Connections and write the username to auth.log

I have a small server that authenticate users as root using their ssh-keys stored in authorized_keys file. I also run fail2ban. I made a convention to have a nickname written after the public_key of ...
0 votes
1 answer
215 views

linux fail2ban not catching auth a specific fail with postfix

I had journalctl open and noticed an offender repeatedly hitting me with auth fails in postfix. I have a standard postfix-sasl filter on by default that, to my knowledge, is working well. It wasn't ...
2 votes
1 answer
336 views

Fail2ban Auto Whitelist

We use fail2ban on a number of our servers for blocking brute-force attempts against services like SSH, SMTP, IMAP, SIP, etc, and it works very well. However, we get a lot of false positives under ...

1
2 3 4 5
15