Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

0
votes
1answer
13 views

fail2ban apache-badbots not blocking IP

I'm trying to get fail2ban to block certain bad bots from hammering my website. I started off with just enabling the default "apache-badbots" in jail.local (I did change the logpath to match my own ...
1
vote
1answer
21 views

how to configure `sshd_config` so fail2ban can see bots

I've updated my sshd_config to be more strict against bots. namely: only keys are allowed, except for a few specified users on specific ips MaxAuthTries = 1 no root login This has been both good ...
0
votes
1answer
77 views

I'm trying to catch brute force against /xmlrpc.php with fail2ban

I'm getting a ton of failed a ton of failed access: 185.103.252.174 - - [28/Apr/2016:15:09:16 -0400] "POST /xmlrpc.php HTTP/1.1" 499 0 "-" "Googlebot/2.1 (+http://www.google.com/bot.html)" ...
0
votes
0answers
16 views

Can fail2ban detect and block IP-ranges?

Every day I get hundreds of this lines in my mail.log: Apr 28 11:10:28 servername amavis[30077]: (30077-08) Blocked SPAM {DiscardedInbound,Quarantined}, [185.140.110.16] <xxx@yyy.com> -> ...
0
votes
0answers
24 views

Having trouble getting correct information from Motion camera streaming server for fail2ban

I have a camera running a Motion streaming server, which uses simple HTTP md5 authentication, tunneled through stunnel on the server side. I'm using like to have fail2ban limit requests just for ...
0
votes
0answers
19 views

fail2ban: regex to block \x00 requests?

Every once in a while my server goes down, and when I check my nginx logs, I usually see something like this: 78.37.54.31 - - [20/Apr/2016:20:58:51 +0300] ...
0
votes
1answer
615 views

How to protect Nginx from HULK DoS tool

There is a tool called HULK (Http Unbearable Load King). It's a web server denial of service tool. It is designed to generate volumes of unique and obfuscated traffic at a webserver, bypassing caching ...
1
vote
1answer
13 views

Fail2ban logging correct ip on Varnish but still not locked out

I am trying to configurefail2ban to ban bad WordPress login attempts, but I'm not having much success. I am using WP fail2ban 3.0.0, which correctly logs bad login attempts on /var/log/secure, as far ...
2
votes
3answers
70 views

Do AWS Servers need fail2ban?

I saw that while I was creating my AWS instance I opted for only my IP address being able to access my server. Also There is a RSA key that is configured for you. In this case do I really need ...
1
vote
2answers
5k views

Connection refused after installing vsftp on Ubuntu 8.04 with fail2ban

I have been using an Ubuntu 8.04 server with fail2ban for a while now (12+ months) and using ftp over SSH without any problems. I have a new user that needs to put files onto the server from an IP ...
-1
votes
1answer
30 views

Which Nginx log file is for fail2ban?

I have files in /var/log/nginx/ the log file /var/log/nginx/access.log is empty. But the /var/log/nginx/access.log.1 is being appended as always. In file /etc/fail2ban/fail2ban.conf, logtarget = ...
0
votes
0answers
21 views

Fail2Ban WordPress filter not working on Debian VPS

I am having trouble getting WordPress Fail2Ban filter to work. I have installed the WP Fail2Ban plugin using the latest update which had a few changes, however, nothing is getting blocked. Here is a ...
-1
votes
0answers
20 views

Keep getting emails from root with site IP - Ip addresses banned

I keep getting emails from my Server root that IP addresses have been banned. The issue is that the IP addresses that are listed in the email are the same Ips for my server Ips. Banned the ...
1
vote
2answers
2k views

Why fail2ban 0.8 doesn't start properly on Debain 7 Wheezy x64?

Why fail2ban 0.8 doesn't start properly on Debain 7 Wheezy x64? Hi, I'm trying to configure fail2ban to work with APF. But first, it would be great if fail2ban can start. root@akdom:/var/log# ...
0
votes
1answer
18 views

Fail2Ban login filter not working on Debian Web Server

So I am having issues getting Fail2Ban to work with as a custom filter for a web app login. First of all, other filter do work such as NGINX Auth. However, my emails have stopped working, not sure why ...
1
vote
1answer
2k views

How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?

Fail2Ban on Ubuntu 10.04 Configuration files /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1 bantime = 10 # made for test purposes maxretry = 3 backend = polling destemail = ...
1
vote
1answer
25 views

Allow winscp/filezilla through iptables and fail2ban

I just launched a website within my school community and woke up this morning to logs of someone trying to bruteforce into my server. I followed some guides on digitalocean to set up fail2ban and ...
0
votes
1answer
18 views

sending command to salt from fail2ban

what I'm trying to do is modify my action.d/iptables-allports.conf: actionban = ssh fail2ban@saltmaster.net 'salt '*' iptables.insert position=1 rule='-s <ip> -j DROP -m comment --comment ...
0
votes
1answer
52 views

Fail2ban compatibility debian debian jessie systemd

Fail2ban debian jessie package not working: On fresh debian jessie with openssh-server (tested in docker container): root@2b29327677c8:/# cat /etc/debian_version 8.3 root@2b29327677c8:/# apt-get ...
0
votes
0answers
33 views

fail2ban regex correctly write

Sorry for my bad english. Server nginx. Block /administrator/ http_access_module nginx-error.log [error] 10934#0: *11435 access forbidden by rule, client: 213.87.x.x, server: localhost, request: ...
0
votes
1answer
2k views

Fail2Ban does not ban VSFTPD users

He guys, i run CentOS5.6 (final), and i just installed FAIL2BAN version (0.8.4-23.el5). I have set it up to ban SSH and VSFTPD attacks. As you can see here: http://pastebin.com/RLyzGgBe fail2ban has ...
2
votes
1answer
197 views

fail2ban regex filter doesnt work with nginx log files

I have been banging my head all day trying to match my regex filter to my access.log with no luck. I have installed fail2ban on a gentoo server and its running fine (i manually baned my own IP and it ...
0
votes
0answers
17 views

fail2ban error: “WARNING Too much read error. Set the jail idle”

I get this error after a few days and it renders the fail2ban to ignore attacks on the specific filter: 2016-03-11 17:06:35,686 fail2ban.filter : ERROR Unable to get stat on ...
0
votes
0answers
18 views

Fail2ban fails to start when setting an action

After installing fail2ban and modifying its configuration it fails to start whenever i set the action to anything... here is the error, but note that $(action_mwl)s can will be diferent for any ...
0
votes
0answers
14 views

Fail2Ban bans all ports/protocols instead of specific port(s)

My jail.local: [siplimit-ban] findtime = 300 enabled = true filter = siplimit protocol = udp logpath = /var/log/syslog maxretry = 15 bantime = 3600 port = 5060,5061 And my iptables after ...
1
vote
0answers
43 views

Fail2ban floods and slow response time

I tried searching for this; I found many people asking but I wasn't successfully to find a working (for me) solution. I have an application that logs each connection on a custom log file. When ...
1
vote
1answer
46 views

Fail2ban bans me after sending successful 5 mails

Dear all I am using Fail2Ban v0.8.13 on CentOS 6 system in order to protect my Postfix servers. Basically it works so after 5 wrong login attempts on SMTP I get banned. Fail2Ban Jail conf ...
0
votes
1answer
45 views

Does fail2ban start automatically each time system starts?

I've just installed Fail2ban on Ubuntu 14.04 and there's something I want to ask: Does fail2ban start automatically each time system starts? I think so, but just want to make sure, since I've read ...
8
votes
4answers
18k views

In Fail2Ban, How to Change the SSH port number?

In my server, the ssh port is not the standard 22. I have set a different one. If I setup fail2ban, will it be able to detect that port? How can I tell it to check that port rather than port 22? The ...
0
votes
0answers
19 views

Optimizing log file size on Ubuntu VM

This is a fact-finding question. I'm implementing fail2ban to keep some unscrupulous elements out of my Django website's experience. Note that my webserver is nginx (reverse proxy) with gunicorn as ...
0
votes
1answer
260 views

fail2ban wont ban ssh from local hosts

I'm trying to configure fail2ban to block ssh from a local hosts. Fail2ban is install on CentOS 7 with firewall (Linux 3.10.0-229.4.2.el7.x86_64 x86_64 ). I have copied the jail.conf to jail.local i ...
-4
votes
2answers
85 views

Fail2Ban to block IPs that request the same URL repeatedly [duplicate]

Is it possible to use Fail2Ban to block IPs that request the same URL more than 5 times in 10 seconds? I'm not talking about a specific URL, but any random URL of the site that is being requested ...
0
votes
1answer
32 views

phpmyadmin fail2ban failed login log

I have a Debian server with phpmyadmin. I want to use fail2ban to block brute force attack. I have questions: How can I log the failed login attempts to log? Where to set that? I can only find ...
6
votes
2answers
6k views

Custom fail2ban Filter for phpMyadmin bruteforce attempts

In my quest to block excessive failed phpMyAdmin login attempts with fail2ban, I've created a script that logs said failed attempts to a file: /var/log/phpmyadmin_auth.log Custom log The format of ...
52
votes
8answers
104k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
11
votes
5answers
2k views

Sharing of fail2ban banned IPs

I'm using fail2ban on all servers with publicly visible services and I wonder: Is there an easy way to share banned IPs between hosts I control? Is there a service out there collecting and ...
4
votes
4answers
4k views

Fail2Ban on CentOS 6.5 Never Bans

Environment: *CentOS 6.5 *Fail2Ban 0.8.14-1 *date outputs the correct date Behavior: Fail2ban starts successfully, but does not create iptables blocks after bad SSH login attempts. I'm only concerned ...
4
votes
2answers
4k views

Fail2Ban - how to prevent my ISP IP dynamic get banned?

I have just installed Fail2Ban. I want to add my ISP IP to my ignore list but my IP is dynamic. In the jail.conf file, I have like this: [DEFAULT] # "ignoreip" can be an IP address, a CIDR mask or ...
0
votes
1answer
93 views

Make Fail2ban parse latest logs generated monthly.

I have a log file generated monthly (e.g messageApril2015.log,messageMay2015.log). Can anyone tell me how to make fail2ban parse the latest log? I have read somewhere about adding %F%Y but it didn't ...
4
votes
4answers
943 views

fail2ban bans me after a series of *successful* logins

I created a passwordless ssh login for one of my servers by using the authorized_keys file. The server has fail2ban on it, and I noticed that after several successful logins I could no longer log in ...
0
votes
0answers
34 views

Nagios check_log reset to OK after notification

Fail2ban is installed on one of the servers, I'm able to ban every IP that try to log in. I'm using the check_log plugin of Nagios to capture the last line of the fail2ban.log, it compares to the ...
3
votes
1answer
90 views

Should i use Firewalld or Iptables for Fail2ban in Centos 7?

I'm setting up Fail2ban to protect ssh, and I use firewalld, I saw a lot of people recommending to use anaction = iptables-multiport and other solutions using iptables instead of firewalld claiming ...
0
votes
1answer
45 views

Unable to reinstall fail2ban after completly removing it from Centos 7

After completely removing Fail2ban from Centos 7, I decided to reinstall it. So I run the installation(yum), and everything seems ok, no errors, But the it seems like the installation does not create ...
0
votes
0answers
34 views

fail2ban doesnt read log if file being used

My environment is Ubuntu 14.04, LAMP stack all from apt. implemented fail2ban and configured jail.local with backend = auto [ssh] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log ...
0
votes
0answers
71 views

Issue with Fail2ban and Mikrotik Firewall

OS: CentOS 7.1 At my organization we are currently assessing using Fail2ban with the firewall on our Mikrotik router. I want Fail2ban to communicate any IP flagged as banned to the Mikrotik ...
1
vote
1answer
90 views

Fail2Ban regex to match these lines?

I've been trying to get fail2ban to work with the Xeams email spam filter. But, I can't figure out what possible regex I should use to match the logs. The logs are in this format. 61.240.144.65 ...
0
votes
1answer
50 views

Fail2ban with Hipchat server

Has anyone managed to get fail2ban working with hipchat server? I've found the log file and here's an example of a failure; Authentication for 'user@domain.com' failed. HTTP code: 403, XMPP error: ...
1
vote
1answer
45 views

Fail2Ban regex is wrong?

I'm currently setting up a filter to filter POST attacks on a file named xmlrpc.php. Requests that should be monitored in the log access look like: 1.99.437.201 - - [01/Feb/2016:01:57:14 +0000] "POST ...
1
vote
2answers
169 views

Configure Fail2ban for SSH and ldap

I have a fail2ban Installation on two Centos7 machine. And I want to secure SSH with it so I installed (The SSH protecting seems active) and set the allowed pw-fails to 5 and I left the banntime at ...
0
votes
2answers
235 views

How to check if firewalld is blocking an incoming ip address?

I have CentOS 7 with firewalld. I installed fail2ban and using the firewallcmd-new action. I am seeing bans in the fail2ban logs, and I want to check in firewallcmd if they are blocked. How can I do ...