Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

3
votes
1answer
138 views

How do I automatically ban udp short packet with fail2ban?

This logfile /var/log/kern.log contains some IP addresses, which I would like the system to automatically ban/block. Basicaly, a packet is from the UDP protocol, and is a short packet, then I would ...
7
votes
3answers
348 views

Banning IPv6 addresses

I am currently accustomed to using tools like fail2ban to keep unwanted traffic away from my servers by banning IPv4 addresses: too many bad log entries per IP, ban the IP. However when the world ...
0
votes
1answer
837 views

How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?

Fail2Ban on Ubuntu 10.04 Configuration files /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1 bantime = 10 # made for test purposes maxretry = 3 backend = polling destemail = ...
0
votes
1answer
28 views

Configuring varnish to write an apache error log with IP addresses

I am in the process of installing fail2ban on a webserver which runs Varnish. Many on the 'jails' require access to the apache/php error logs. One of the problems I have is that all of the refernces ...
0
votes
1answer
26 views

Fail2Ban: I'm having trouble creating a regex for my Dovecot filter

I am trying to create a regex filter for my failed Dovecot entries in the maillog file. What I have created is: .*dovecot: auth: sql\(.*,<HOST>\): Password mismatch The target line in the ...
0
votes
2answers
28 views

Massive blockingof ips done right

I run a website which is being abused every day with bots trying to send spam, not respecting robots.txt and so on. The biggest problem, however is repeating attempts to massively harvest website. ...
0
votes
0answers
7 views

Fail2ban apache-myadmin regex

I've got a jail set up with the following regex, which I took from a standard filter file: apache-myadmin.conf failregex = ^[[]client <HOST>[]] File does not exist: *myadmin* *\s*$ ...
1
vote
2answers
34 views

fail2ban with static IP

Is there any point to running fail2ban to protect your SSH connection if you connect from a static IP? As far as I can see having fail2ban running means that you effectively open up port 22 to ...
1
vote
1answer
218 views

How to ban Syn Flood Attacks using Fail2Ban?

In my log, I am frequently seeing dropped ips like this: > Oct 30 17:32:24 IPTables Dropped: IN=eth0 OUT= > MAC=04:01:2b:bd:b0:01:4c:96:14:ff:df:f0:08:00 SRC=62.210.94.116 > ...
0
votes
2answers
59 views

Use Fail2ban to block proxied dovecot password attempts

I've searched around a great deal with this, but can't manage to come up with a solution. The easiest way of explaining it, is I used to have just 1 email server, now I have 2. The 1st email server ...
6
votes
2answers
164 views

How to *add* rules in local fail2ban filter definition?

I have installed fail2ban as packaged by Debian on a server under my control. Since I have some failregexes from before, I'm putting those into the local filter definition file so they will be ...
-4
votes
1answer
77 views

make fail2ban use public blacklists

I've been searching high and low for a way to connect fail2ban with blocklist.de (or any other public blacklists, for that matter, as long as fail2ban can report to it). Pretty much every result that ...
15
votes
6answers
25k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
1
vote
1answer
113 views

Why is fail2ban not banning this attack?

I have fail2ban installed to ban bruteforce attempts on the ssh password. There are business requirements for not disabling password authentication on this machine. fail2ban was installed using the ...
0
votes
0answers
136 views

Fail2ban not banning IP's

Running a new install of OpenSuse 13.2 (Running rsyslog) My jail.conf file contains: [ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] ...
0
votes
0answers
23 views

Writing a fail2ban multiline regex

I've got some troublesome hosts trying it on with an SSH server I run, and I'm trying to ban them using fail2ban. Problem is, I haven't done much work with regexes, and even less with Python regexes. ...
0
votes
0answers
43 views

Fail2Ban Correctly Attempts to Ban IP but IP does not get banned - iptables chain exists but not working

Running on Ubuntu 14.04 Server. So I have fail2ban correctly configured to process /var/log/auth.log for SSH login attempts. Upon 3 failed attempts I see this in the fail2ban log: 2014-11-19 ...
1
vote
1answer
15 views

Debian Fail2ban action.d and filter.d scripts

I have a debian wheezy server on which I use Fail2ban that was loaded with the package installer. I noticed that while the version on my server (0.8.6-3wheezy3) is current, it does not match up with ...
0
votes
3answers
496 views

fail2ban error about python?

I have just installed fail2ban on my debian7 machine but whenever i start it i get a lot of error which seems to be about python? [....] Restarting authentication failure monitor: fail2banTraceback ...
1
vote
1answer
40 views

Debian port(s) not responding

I am fairly new to servers. I am trying to run a shoutcast server on debian. Shoutcast runs on a default port of 8000. My problem is it will not load when visiting xxx.xxx.xx.xxx:8000. When I log in ...
0
votes
1answer
60 views

Fail2ban does not ban any ip-adresses with vsftpd

Fail2ban starts okey. It work with my sshd filter and bans IP-adresses as it should. But with vsftpd it does not register failed logins when I run: fail2ban-client status vsftpd I have tried both ...
1
vote
0answers
63 views

Is fail2ban working?

I recently installed 2 new servers with Centos 7. I have enabled fail2ban with defaults. I have ensured it is running as ps -ax | grep fail2ban yields: 1996 ? S 0:04 /usr/bin/python ...
3
votes
2answers
838 views

Fail2Ban: already banned?

I have Fail2Ban running on my Centos Server. (Config below) In my var/log/messages I noticed something really weird: Jun 19 12:09:32 localhost fail2ban.actions: INFO [postfix] 114.43.245.205 ...
6
votes
4answers
5k views

Permanent block of IP after n retries using fail2ban

I have a fail2ban configured like below: block the ip after 3 failed attempts release the IP after 300 sec timeout This works perfectly and I want to keep it this way such that a valid user gets a ...
0
votes
1answer
221 views

Fail2ban MTA=Postfix Setting in Jail Config giving Error

In /etc/fail2ban/jail.local, when I have the MTA setting to Postfix, Fail2Ban is showing an error and is unable to start. [DEFAULT] ignoreip = 127.0.0.1/8 bantime = 1800 ...
0
votes
0answers
107 views

fail2ban not banning properly

I set up fail2ban on a cpanel server running CSF. In order to avoid collisions, I removed all filters except common.conf and the one filter I need it for, apache-postflood.conf. My post flood conf is ...
0
votes
0answers
39 views

What does Nginx Proxy Filter in Fail2ban really do?

What does Nginx Proxy Filter in Fail2ban really do? I am currently setting up Fail2Ban for Nginx. Almost everywhere I've read, they all have included a setting for [nginx-proxy] proxy filter. From ...
1
vote
1answer
82 views

Fail2ban jail.local vs jail.conf

Does jail.local file act as an override to jail.conf or as a replacement to jail.conf? When I was learning about Fail2Ban from tutorials, most of them usually say either to copy jail.conf to ...
0
votes
1answer
53 views

fail2ban flushing my existing IPTABLES rules

I just implemented fail2ban on a server for testing purposes. I have a BLACKLIST chain which blocks a huge set of CIDR masks that I don't want to reach my server. When fail2ban is triggered by a ...
0
votes
1answer
52 views

Fail2ban not working on Ubuntu 12.04

I'm trying to implement fail2ban on a Ubuntu 12.04 x64 server. I've done the following: apt-get install fail2ban Made a copy of jail.conf in /etc/fail2ban/jail.conf.local here's an excerpt: ...
1
vote
1answer
2k views

fail2ban running on CentOS 7 & getting “ssh connection refused”

Is anyone successfully running fail2ban on CentOS 7 and can tell me how to do it? I tried to install fail2ban with yum install fail2ban and run it (there are no extra rules in iptables -L which seems ...
4
votes
3answers
2k views

fail2ban not working on fresh install of ubuntu 14.04, why?

After installing and configuring fail2ban, I tried to login to my server through ssh with a wrong password. After a few attempts, I tried with the correct password with success. So, fail2ban didn't ...
4
votes
4answers
1k views

How to block all root login attempts using denyhosts and or fail2ban?

I currently block all ssh logins using root. But I wanted to go the extra mile and block the ip address of the client who tried to login as root. I currently have denyhosts and fail2ban setup and ...
2
votes
0answers
28 views

Blocking bot by multi url pattern with fail2ban

I'm seeing a multi url pattern similar to following lines in nginx logs recently. GET / GET /somepath/ GET /otherpath/ GET / GET /somepath/ GET /otherpath/ ... I'm already using fail2ban for ...
0
votes
3answers
560 views

Fail2Ban on CentOS 6.5 Never Bans

Environment: *CentOS 6.5 *Fail2Ban 0.8.14-1 *date outputs the correct date Behavior: Fail2ban starts successfully, but does not create iptables blocks after bad SSH login attempts. I'm only concerned ...
0
votes
2answers
384 views

Fail2Ban is not adding iptables rules

Fail2Ban is not adding iptables rules to block attackers. I'm running CentOS 6.5 (32 bit) Here's what I did: fail2ban was installed via yum using the epel repo I copied jail.conf to jail.local I ...
27
votes
7answers
22k views

Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

I'm setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I've seen many recommendations for both denyhosts and fail2ban, but few comparisons of the ...
0
votes
1answer
267 views

Fail2Ban - Iptables - Set does not exist

I have a very strange problem with fail2ban/iptables. Something is not working right, but I can't figoure out what. I have added this conf & and filter for fail2ban: [wordpress-register] enabled ...
5
votes
3answers
2k views

Why is iptables not blocking an ip address?

I have configured fail2ban to monitor a certain pattern of malicious traffic I'm getting and ban IP addresses associated. Everything seems to be working great -- the regex is matching the pattern ...
1
vote
2answers
120 views

Run fail2ban without banning

It is possible to run fail2ban in some kind of "simulation mode" so it does not ban but log somewhere who it would have ban? Running fail2ban on Ubuntu 12.04.
1
vote
1answer
131 views

Trouble with Fail2Ban UFW Portscan Filter

I'm trying to create a filter for fail2ban that recognises port scans in the UFW logs. I've confirmed my ban action is working correctly on other filters and am having trouble creating the correct ...
2
votes
1answer
137 views

How to use so called action variables in fail2ban?

I've seen a few mentions of these in the docs and misc scripts, but nothing concrete on exactly how they are used. Could anyone give me some examples? Is it just a case of myvar=7 . . . [ssh] ...
0
votes
0answers
131 views

How to protect tomcat application - user authentication with fail2ban?

AFAIK tomcat6 does not use Apache std .htaccess auth, but has own user authentication method. My question is: How to protect it against brute force attack with fail2ban ?
1
vote
1answer
997 views

Fail2Ban Testing

Running the following testing script to see if Fail2ban is working: fail2ban-regex /var/log/apache*/*access.log /etc/fail2ban/filter.d/apache-auth.conf I get this response: Running tests ...
0
votes
1answer
1k views

Fail2Ban does not ban VSFTPD users

He guys, i run CentOS5.6 (final), and i just installed FAIL2BAN version (0.8.4-23.el5). I have set it up to ban SSH and VSFTPD attacks. As you can see here: http://pastebin.com/RLyzGgBe fail2ban has ...
0
votes
1answer
80 views

Brute force attacks with server's IP

I am running a Debian wheezy server with fail2ban installed, everything works as expected but recently my own server got banned. I added the server's IP in the exception row and it seems to work, but ...
3
votes
3answers
285 views

Sharing of fail2ban banned IPs

I'm using fail2ban on all servers with publicly visible services and I wonder: Is there an easy way to share banned IPs between hosts I control? Is there a service out there collecting and ...
0
votes
1answer
72 views

Logging 403 Rewrites for Brute Force Attacks

As explained in Wordpress Codec, I want to prevent brute force attacks for wp-login.php via RewritetRule. http://codex.wordpress.org/Brute_Force_Attacks#Deny_Access_to_No_Referrer_Requests Rather ...
0
votes
1answer
72 views

fail2ban block ports rules iptable

I just installed Ubuntu Server 14.04 and don't have much experience with IPtables. I am trying to get a basic setup going where I only accept SSH connections on port 22 and 2222. I actually have that ...
0
votes
1answer
72 views

SELinux problems running Expect script from fail2ban

I have an Expect script that works fine if I run it manually, but fails when run as an action from Fail2ban. The error message is as follows: spawn /usr/bin/telnet 192.168.242.1 The system has no ...