Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

1
vote
2answers
2k views

Why fail2ban 0.8 doesn't start properly on Debain 7 Wheezy x64?

Why fail2ban 0.8 doesn't start properly on Debain 7 Wheezy x64? Hi, I'm trying to configure fail2ban to work with APF. But first, it would be great if fail2ban can start. root@akdom:/var/log# /etc/...
1
vote
1answer
22 views

Rule of fail2ban not working when the request is from the brute force attack

I have a situation where some IP from moldova try everyday discover my basic auth credentials with some type of brute force attack. However I have a rule with fail2ban that should avoid this ...
-1
votes
2answers
11 views

What does the FAIL2BAN BadBots block ? Only Authentication related?

I am wondering if fail2ban is used only in order to block IP addresses that are from which there are authentication failures (SSH / HTTP auth. etc) or that it is also used for blocking Bots which ...
1
vote
1answer
2k views

How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?

Fail2Ban on Ubuntu 10.04 Configuration files /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1 bantime = 10 # made for test purposes maxretry = 3 backend = polling destemail = email@...
9
votes
4answers
20k views

In Fail2Ban, How to Change the SSH port number?

In my server, the ssh port is not the standard 22. I have set a different one. If I setup fail2ban, will it be able to detect that port? How can I tell it to check that port rather than port 22? The ...
1
vote
1answer
10 views

CentOS7: Run Fail2Ban on existing log with new regex

I've added some regex rules for sshd and want to ban all users in /var/log/secure that match this regex within the jail rules (3 attempts, 24 hours). But I do not want to wait for them to try again, ...
12
votes
6answers
2k views

Sharing of fail2ban banned IPs

I'm using fail2ban on all servers with publicly visible services and I wonder: Is there an easy way to share banned IPs between hosts I control? Is there a service out there collecting and ...
1
vote
1answer
32 views

Fixing fail2ban regex rule for php-url-fopen filter

I'm fixing default php-url-fopen filter to allow some GET query parameters which I'm using in my system (it's not publicly available, but I would still like to block unnecessary requests). The problem ...
1
vote
0answers
212 views

What does Nginx Proxy Filter in Fail2ban really do?

What does Nginx Proxy Filter in Fail2ban really do? I am currently setting up Fail2Ban for Nginx. Almost everywhere I've read, they all have included a setting for [nginx-proxy] proxy filter. From ...
0
votes
2answers
648 views

Fail2ban does not ban any ip-adresses with vsftpd

Fail2ban starts okey. It work with my sshd filter and bans IP-adresses as it should. But with vsftpd it does not register failed logins when I run: fail2ban-client status vsftpd I have tried both ...
0
votes
0answers
17 views

Fail2ban failed: option ignoreip in section DEFAULT already exists

tl;dr Fail2ban behaves differently depending on OS, one throwing an error and one working fine with a duplicate directive. Environment Ubuntu 16.04 Fail2Ban v0.9.3 (what's in the repos as of time ...
1
vote
1answer
50 views

fail2ban: regex to block \x00 requests?

Every once in a while my server goes down, and when I check my nginx logs, I usually see something like this: 78.37.54.31 - - [20/Apr/2016:20:58:51 +0300] "\x00\x00\x00TZ\x00\x00\x00\x00\x00\x00\x00\...
0
votes
0answers
21 views

How do I get host's systemd journal to see any systemd-nspawn container's systemd journal?

I have sshd listening on a variety of ports in variety of containers. There's a fail2ban instance deployed on the host. I would like the host's fail2ban instance to be able to follow all container ...
0
votes
0answers
28 views

Fail2ban on CentOS, dovecot filters regex not matching logs

I'm starring at this regex for some time now and it seems perfectly matching lines from my log files but I can't get it to work, not even with modifications. I suspect the problem might be with the ...
66
votes
8answers
119k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
0
votes
0answers
50 views

IP not showing in /var/log/secure under rhost

I'm trying to get Fail2Ban to block failed sudo -i commands, but the IP is not showing up in the logs. For example when I log into the server with: ssh -i ~/.ssh/id_rsa USER@1.2.3.4 I then use: ...
0
votes
2answers
33 views

fail2ban - virtual host specific

Is it possible to set up fail2ban to ban ip addresses only for certain virtualhost? For example I have a filter that detects various attempts to run *.php file inside website structure. Which I would ...
0
votes
0answers
62 views

Fail2ban 0.9.3 not working on centos7.2

I'm really struggling with this. The default [sshd] jail works fine. Status for the jail: sshd |- Filter | |- Currently failed: 0 | |- Total failed: 0 | `- File list: /var/log/secure `- Actions ...
0
votes
0answers
47 views

Fail2ban error 'database is locked' when trying to start / restart it

I am currently reinstalling fail2ban to have a fresh version, because i've modified it quite a lot of time since I installed it for the first time, and I wanted to default settings for it. Once ...
0
votes
0answers
11 views

activate geoip settings when certain locations detected

I have a website that is attacked from time to time by ddos attackers. Such attack can disable the webpage for days. The webpage serves for few countries so if I know about the attack, the solution is ...
0
votes
0answers
11 views

fail2ban is interpolating invalid brackets for jail name

I have a fail2ban action with an actioncheck definition like so: actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name> This is part of a repeat offenders script I found, and ...
0
votes
2answers
602 views

ERROR Found no accessible config files for 'fail2ban' under /etc/fail2ban

So my fail2ban wasn't working and in attempts to make it work the config files got messy. Decided to start from scratch. I ran these as sudo apt-get remove fail2ban apt-get purge fail2ban rm -r /...
1
vote
1answer
37 views

Fail2ban not respecting email settings

In Fail2ban I have set up my email settings as: # Destination email address used solely for the interpolations in # jail.{conf,local} configuration files. destemail = me@hotmail.com # # Name of the ...
0
votes
0answers
26 views

fail2ban jail not working

I am struggling to get a single jail working in fail2ban. Fail2ban seems functional, and other jails are working. I have tried using fail2ban-regexp and it seems to be matching multiple times, but ...
0
votes
1answer
45 views

fail2ban apache-badbots not blocking IP

I'm trying to get fail2ban to block certain bad bots from hammering my website. I started off with just enabling the default "apache-badbots" in jail.local (I did change the logpath to match my own ...
1
vote
1answer
27 views

how to configure `sshd_config` so fail2ban can see bots

I've updated my sshd_config to be more strict against bots. namely: only keys are allowed, except for a few specified users on specific ips MaxAuthTries = 1 no root login This has been both good ...
1
vote
1answer
128 views

I'm trying to catch brute force against /xmlrpc.php with fail2ban

I'm getting a ton of failed a ton of failed access: 185.103.252.174 - - [28/Apr/2016:15:09:16 -0400] "POST /xmlrpc.php HTTP/1.1" 499 0 "-" "Googlebot/2.1 (+http://www.google.com/bot.html)" 173.246.56....
0
votes
0answers
26 views

Can fail2ban detect and block IP-ranges?

Every day I get hundreds of this lines in my mail.log: Apr 28 11:10:28 servername amavis[30077]: (30077-08) Blocked SPAM {DiscardedInbound,Quarantined}, [185.140.110.16] <xxx@yyy.com> -> <...
0
votes
0answers
34 views

Having trouble getting correct information from Motion camera streaming server for fail2ban

I have a camera running a Motion streaming server, which uses simple HTTP md5 authentication, tunneled through stunnel on the server side. I'm using like to have fail2ban limit requests just for ...
0
votes
1answer
653 views

How to protect Nginx from HULK DoS tool

There is a tool called HULK (Http Unbearable Load King). It's a web server denial of service tool. It is designed to generate volumes of unique and obfuscated traffic at a webserver, bypassing caching ...
1
vote
1answer
35 views

Fail2ban logging correct ip on Varnish but still not locked out

I am trying to configurefail2ban to ban bad WordPress login attempts, but I'm not having much success. I am using WP fail2ban 3.0.0, which correctly logs bad login attempts on /var/log/secure, as far ...
2
votes
3answers
105 views

Do AWS Servers need fail2ban?

I saw that while I was creating my AWS instance I opted for only my IP address being able to access my server. Also There is a RSA key that is configured for you. In this case do I really need ...
1
vote
2answers
5k views

Connection refused after installing vsftp on Ubuntu 8.04 with fail2ban

I have been using an Ubuntu 8.04 server with fail2ban for a while now (12+ months) and using ftp over SSH without any problems. I have a new user that needs to put files onto the server from an IP ...
-1
votes
1answer
48 views

Which Nginx log file is for fail2ban?

I have files in /var/log/nginx/ the log file /var/log/nginx/access.log is empty. But the /var/log/nginx/access.log.1 is being appended as always. In file /etc/fail2ban/fail2ban.conf, logtarget = /...
0
votes
0answers
36 views

Fail2Ban WordPress filter not working on Debian VPS

I am having trouble getting WordPress Fail2Ban filter to work. I have installed the WP Fail2Ban plugin using the latest update which had a few changes, however, nothing is getting blocked. Here is a ...
0
votes
1answer
34 views

Fail2Ban login filter not working on Debian Web Server

So I am having issues getting Fail2Ban to work with as a custom filter for a web app login. First of all, other filter do work such as NGINX Auth. However, my emails have stopped working, not sure why ...
1
vote
1answer
48 views

Allow winscp/filezilla through iptables and fail2ban

I just launched a website within my school community and woke up this morning to logs of someone trying to bruteforce into my server. I followed some guides on digitalocean to set up fail2ban and ...
0
votes
1answer
28 views

sending command to salt from fail2ban

what I'm trying to do is modify my action.d/iptables-allports.conf: actionban = ssh fail2ban@saltmaster.net 'salt '*' iptables.insert position=1 rule='-s <ip> -j DROP -m comment --comment "<...
0
votes
1answer
119 views

Fail2ban compatibility debian debian jessie systemd

Fail2ban debian jessie package not working: On fresh debian jessie with openssh-server (tested in docker container): root@2b29327677c8:/# cat /etc/debian_version 8.3 root@2b29327677c8:/# apt-get ...
0
votes
0answers
43 views

fail2ban regex correctly write

Sorry for my bad english. Server nginx. Block /administrator/ http_access_module nginx-error.log [error] 10934#0: *11435 access forbidden by rule, client: 213.87.x.x, server: localhost, request: "...
0
votes
1answer
2k views

Fail2Ban does not ban VSFTPD users

He guys, i run CentOS5.6 (final), and i just installed FAIL2BAN version (0.8.4-23.el5). I have set it up to ban SSH and VSFTPD attacks. As you can see here: http://pastebin.com/RLyzGgBe fail2ban has ...
2
votes
1answer
271 views

fail2ban regex filter doesnt work with nginx log files

I have been banging my head all day trying to match my regex filter to my access.log with no luck. I have installed fail2ban on a gentoo server and its running fine (i manually baned my own IP and it ...
0
votes
0answers
31 views

fail2ban error: “WARNING Too much read error. Set the jail idle”

I get this error after a few days and it renders the fail2ban to ignore attacks on the specific filter: 2016-03-11 17:06:35,686 fail2ban.filter : ERROR Unable to get stat on /srv/www/canalbases/logs/...
0
votes
0answers
39 views

Fail2ban fails to start when setting an action

After installing fail2ban and modifying its configuration it fails to start whenever i set the action to anything... here is the error, but note that $(action_mwl)s can will be diferent for any ...
0
votes
0answers
18 views

Fail2Ban bans all ports/protocols instead of specific port(s)

My jail.local: [siplimit-ban] findtime = 300 enabled = true filter = siplimit protocol = udp logpath = /var/log/syslog maxretry = 15 bantime = 3600 port = 5060,5061 And my iptables after ...
1
vote
0answers
72 views

Fail2ban floods and slow response time

I tried searching for this; I found many people asking but I wasn't successfully to find a working (for me) solution. I have an application that logs each connection on a custom log file. When ...
1
vote
1answer
59 views

Fail2ban bans me after sending successful 5 mails

Dear all I am using Fail2Ban v0.8.13 on CentOS 6 system in order to protect my Postfix servers. Basically it works so after 5 wrong login attempts on SMTP I get banned. Fail2Ban Jail conf [sasl-...
0
votes
1answer
104 views

Does fail2ban start automatically each time system starts?

I've just installed Fail2ban on Ubuntu 14.04 and there's something I want to ask: Does fail2ban start automatically each time system starts? I think so, but just want to make sure, since I've read ...
0
votes
0answers
22 views

Optimizing log file size on Ubuntu VM

This is a fact-finding question. I'm implementing fail2ban to keep some unscrupulous elements out of my Django website's experience. Note that my webserver is nginx (reverse proxy) with gunicorn as ...
0
votes
1answer
316 views

fail2ban wont ban ssh from local hosts

I'm trying to configure fail2ban to block ssh from a local hosts. Fail2ban is install on CentOS 7 with firewall (Linux 3.10.0-229.4.2.el7.x86_64 x86_64 ). I have copied the jail.conf to jail.local i ...