Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

0
votes
0answers
5 views

Trouble figuring out a fail2ban log error message: “iptables -n -L INPUT | grep -q 'fail2ban-SSH[ \t]' returned 100”

Here is my jail.local rule for ssh: [ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] logpath = /var/log/messages maxretry = 5 Here is what my ...
0
votes
2answers
1k views

Why fail2ban 0.8 doesn't start properly on Debain 7 Wheezy x64?

Why fail2ban 0.8 doesn't start properly on Debain 7 Wheezy x64? Hi, I'm trying to configure fail2ban to work with APF. But first, it would be great if fail2ban can start. root@akdom:/var/log# ...
2
votes
0answers
66 views

“Centralized” fail2ban only banning attacks to local host

I'm trying to run fail2ban on the rsyslog server that gathers auth logs from the rest of our servers. I'm interested on getting notifications working as a first step. My problem is that fail2ban only ...
4
votes
4answers
5k views

fail2ban not working on fresh install of ubuntu 14.04, why?

After installing and configuring fail2ban, I tried to login to my server through ssh with a wrong password. After a few attempts, I tried with the correct password with success. So, fail2ban didn't ...
0
votes
0answers
27 views

fail2ban wont ban ssh from local hosts

I'm trying to configure fail2ban to block ssh from a local hosts. Fail2ban is install on CentOS 7 with firewall (Linux 3.10.0-229.4.2.el7.x86_64 x86_64 ). I have copied the jail.conf to jail.local i ...
0
votes
1answer
1k views

How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?

Fail2Ban on Ubuntu 10.04 Configuration files /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1 bantime = 10 # made for test purposes maxretry = 3 backend = polling destemail = ...
0
votes
0answers
13 views

Fail2ban not unbanning ip from jail

I've tried finding a way to unban an IP from fail2ban, but no matter what I do it seems to stay banned. I recently ran fail2ban-client get ssh actionunban myip and I do not get an error message, but ...
0
votes
0answers
16 views

fail2ban stops logging after some time (3-4 days)

I've noticed that whenever I want to see fail2ban logs after 3 or 4 days of being working, it compresses the logs to .gz which Im fine with that: -rw-r--r--. 1 root root 90034 May 1 12:49 ...
-2
votes
1answer
21 views

Default rules in fail2ban for apache

What does default apache (apache-auth, apache-overflows, apache-noscript) fail2ban jails do? I looked into docs, but there is nothing about it. Thanks for your help!
-1
votes
0answers
45 views

Fail2Ban / IPTables does not block IPs

My server : Debian Wheezy 7.8, Postfix/Dovecot, Fail2Ban/IPTables I've postfix attacks : /var/log/mail.warn Jun 12 08:03:45 myserver postfix/smtpd[8325]: warning: ...
1
vote
2answers
153 views

Fail2ban critical exception - does not block ips

I'm trying to get fail2ban running on CentOS7 (no SELinux) and it uses firewalld. My goal is to set it to ban Asterisk password fails. Setup was default yum install fail2ban Config-wise I ONLY added ...
1
vote
0answers
23 views

Selinux: Shorewall will not respond to fail2ban

I am using fail2ban with shorewall and my Fedora 21 server & cloud. All flooded with the following error message: SELinux is preventing shorewall from write access on the file ...
0
votes
1answer
29 views

journalctl: Cannot filter ownCloud log lines, fail2ban will not ban

Using a general journalctl command, the log line of interest appears: [root@bee server]# journalctl -n -- Logs begin at Mon 2015-01-26 19:44:33 EET, end at Wed 2015-06-10 21:41:12 EEST. -- ... Jun 10 ...
22
votes
6answers
51k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
-2
votes
1answer
44 views

Apache server crashes due to bandwidth spike issue [closed]

The problem I am facing is that my Website (hosted on a dedicated VPS) was working fine for last 6 months. However from last two days, it gets huge spikes of DATA coming in and this causes server to ...
3
votes
1answer
38 views

Fail2ban redirect

I've just finished setting up fail2ban on my Centos reverse proxy server. I was able to get it to block all requests if a certain criteria was met (pretty straight forward). However, I'd now like ...
-1
votes
1answer
40 views

How to prevent password bruteforce in web application? [closed]

I have php web application (nginx+php-fpm). And someone try to bruteforce password. He have a lot of IPs. Also these bruteforce works like DDOS because each time web application starts and try to ...
7
votes
2answers
6k views

How to set up fail2ban to read multi log in a jail?

How can I configure multiple logpaths for the same rule? I'm trying to write a syntax like this: [apache-w00tw00t] enabled = true filter = apache-w00tw00t action = iptables-allports logpath = ...
0
votes
0answers
23 views

Make Fail2ban parse latest logs generated monthly.

I have a log file generated monthly (e.g messageApril2015.log,messageMay2015.log). Can anyone tell me how to make fail2ban parse the latest log? I have read somewhere about adding %F%Y but it didn't ...
0
votes
0answers
16 views

Bad Referer AND DNS Cache Poisoning [duplicate]

I am annoyed by a lot of bad referer spammers I am seeing in apache's logs. 208.118.126.250 - - [12/May/2015:17:45:06 +0200] "GET /js/parsley.js HTTP/1.1" 200 91434 "http://voiceit.be/logins/login" ...
0
votes
1answer
36 views

Fail2Ban Filter Errors

I'm trying to add two fail2ban filters, one for post flood and phpmyadmin brute force but i get the following errors. logs: fail2ban.filter : ERROR No 'host' group in '[[]client []] File does not ...
0
votes
0answers
57 views

Can't pass Fail2ban banned IP's to CloudFlare in Nginx?

I have Ubuntu 14.04, Nginx 1.6.2, MySQL 10.0.17-MariaDB, PHP 5.5.24 VPS. It running two WordPress sites. I use fail2ban with CSF. Fail2ban I use ban action as route, because iptables-multiport and ...
4
votes
0answers
111 views

How to blacklist or whitelist lots or few ip ranges with ipset and iptables + fail2ban

EDIT: It's astonishing how the urge to find a solution sometimes is sufficient to slowly but steadily lead one towards a solution. Also, the more often I reread my question in order to clarify it, I ...
0
votes
1answer
74 views

fail2ban keeps trying to ban again

I have an issue getting fail2ban to do what I want. I use a action which bans the IP on CLoudFlare, that means that still a lot of requests get through until everything has been updated on ...
0
votes
1answer
97 views

Modify fail2ban failregex to match failed public key authentications via ssh

fail2ban doesn't recognize failed public key ssh logins and I assume that this can be solved by modifying the failregex of /etc/fail2ban/filter.d/sshd.config to match the following line: <date> ...
1
vote
1answer
79 views

fail2ban says banned, but can still log in

Running fail2ban 0.8.14 on CentOS 6.5 with Python 2.6.6, fail2ban puts my IP in the banned list, but doesn't actually prevent me from logging in. Here's an example of a failed ban in ...
0
votes
1answer
1k views

Fail2ban won't start via /etc/init.d/fail2ban but will via /usr/bin/fail2ban-client

I've been running fail2ban successfully for a long time on RHEL. Now all of a sudden starting, stopping and restarting via /etc/init.d/fail2ban no longer works: # /etc/init.d/fail2ban start Starting ...
0
votes
1answer
134 views

ipTables IP Range will not be blocked

I have setup fail2ban with this Tutorial http://wireflare.com/permanently-ban-repeat-offenders-with-fail2ban/ and it seems working. But the attackers are changing their IPs and thats why I decided to ...
0
votes
1answer
95 views

Can't connect to Ubuntu VPS via SSH,SFTP

When I try to login to my VPS using SSH and SFTP it's not connect to the server. Then I power off and power on the VPS by the VPS provider control panel (digital ocean). Once it boot up, first few ...
0
votes
1answer
298 views

Regex for multiple sshd Received disconnect from … [preauth]

What fail2ban regex would catch logs like these? Apr 9 08:48:28 server sshd[1856]: Received disconnect from 43.255.190.117: 11: [preauth] Apr 9 09:06:05 server sshd[1936]: Received disconnect ...
3
votes
1answer
2k views

fail2ban cannot ban ip on all ports if it's already banned for specific port

I'm using a custom filter in fail2ban to search through it's own log and ban an ip after 5 bans from any of the regular filters. I'm using iptables-allports as action for this. All other filters are ...
0
votes
0answers
20 views

How do I ban IP's that request files that do not exist using fail2ban? [duplicate]

I have recently started using Fail2Ban and need to configure a specific 'Jail'. My apache error logs are filled with requests for files within my /var/www folder. The folder doesn't contain any ...
-3
votes
1answer
26 views

What configuration is necessary for fail2ban to be useful? [closed]

If I simply install fail2ban on my server with sudo apt-get install fail2ban without configuring anything, does this provide adequate protection? It seems that fail2ban comes with 1-2 pages of jails ...
0
votes
1answer
151 views

Loading fail2ban rules to iptables using iptables-persistent

I am using iptables-persistent package to reload my iptables on boot. And I have been thinking should I add the fail2ban rules to the loaded config file? Now I am seeing they are duplicated. This is ...
4
votes
3answers
2k views

Fail2Ban: already banned?

I have Fail2Ban running on my Centos Server. (Config below) In my var/log/messages I noticed something really weird: Jun 19 12:09:32 localhost fail2ban.actions: INFO [postfix] 114.43.245.205 ...
0
votes
1answer
33 views

Cannot understand this example fail2ban rule

I'm trying to secure my admin and user login page from brute force attacks. I have setup iptables and the closest thing I can find which looks useful is this: jail file: [nginx-login] enabled = true ...
-1
votes
1answer
33 views

fail2ban identify the subscription specific error log which resulted in an IP ban [closed]

I am running Fail2Ban via Parallels Plesk 12.x on several CentOS 6 containers with several active jails (apache-noscripts, plesk-apache etc.). The Fail2Ban.log provides the IP address which was ...
0
votes
0answers
97 views

prevent phpbb bruteforcing with mod_security

Update: I edited this and added a fail2ban tag. Perhaps that might be another way to handle this issue. I'm running phpbb 3.0.13-PL1 and I would like to protect the login page from bruteforcing. I'm ...
0
votes
0answers
45 views

fail2ban WARNING invalid command on apache2 disabled websites

I have a problem on a Debian Squeezy webserver running fail2ban. Now and then, fail2ban stops working complaining of missing access.log: fail2ban.comm : WARNING Invalid command: ['set', ...
2
votes
2answers
909 views

Why is fail2ban not banning this attack?

I have fail2ban installed to ban bruteforce attempts on the ssh password. There are business requirements for not disabling password authentication on this machine. fail2ban was installed using the ...
0
votes
1answer
84 views

Setup fail2ban with apf

Along with BFD we have recently installed fail2ban on our server, it is CentOS and it uses APF to block IPs. I have hunted online on how to get the two to work however when an IP is blocked by ...
1
vote
3answers
1k views

fail2ban rule results in “iptables returned 200” error message

I just tried to add a new fail2ban rule that is supposed to scan Apache2 error logs for suspicious file access attempts (People who try to access three common login urls that do not exist usually ...
1
vote
1answer
255 views

Fail2ban configuration for nginx using firewallcmd in CentOS 7

Previously I have a CentOS 6.5 with Iptables and I configure some jails for nginx as suggested here: How To use fail2ban for Nginx?. But now I am in CentOS 7, trying to use the new firewall and ...
3
votes
3answers
1k views

Fail2Ban is not adding iptables rules

Fail2Ban is not adding iptables rules to block attackers. I'm running CentOS 6.5 (32 bit) Here's what I did: fail2ban was installed via yum using the epel repo I copied jail.conf to jail.local I ...
0
votes
2answers
691 views

fail2ban statistics? [closed]

Is there a program that parses fail2ban.log and produces some statistics? Or should I set out and write something custom for our hosts? We run mostly Debian and fail2ban with iptables.
2
votes
0answers
440 views

fail2ban fails to block from auth.log with directadmin

i'm using directadmin on a Ubuntu server. i recently installed Fail2Ban. but i'm still recieving "Brute-Force attack" email from directadmin. my jail.conf (only the auth.log jails!): [ssh] enabled ...
1
vote
1answer
241 views

Fail2ban on centos 7 does not add rule to firewall. Firewall-cmd used on system

I installed the latest fail2ban from centos/epel I have added the ssh enabled option in jail.local. I have tried with action and banaction = firewallcmd-ipset neither made any difference. ...
5
votes
2answers
4k views

Custom fail2ban Filter for phpMyadmin bruteforce attempts

In my quest to block excessive failed phpMyAdmin login attempts with fail2ban, I've created a script that logs said failed attempts to a file: /var/log/phpmyadmin_auth.log Custom log The format of ...
1
vote
0answers
89 views

What this error means on Fail2ban?

I've installed fail2ban on my server. Anyway, I've seen this error on Fail2ban Log... What does it means? Here's the error 2015-02-09 06:11:21,076 fail2ban.filter [23563]: INFO ...
1
vote
1answer
221 views

How to interpret postfix logs on Ubuntu

I just installed postfix on my server which runs Ubuntu 14.04.1 LTS. I am a little confused as to how I should interpret the postfix logs located at /var/log/mail.log. Firstly, one of the reasons I ...