Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

7
votes
5answers
4k views

Is it worth the effort to block failed login attempts

Is it worthwhile running fail2ban, sshdfilter or similar tools, which blacklist IP addresses which attempt and fail to login? I've seen it argued that this is security theatre on a "properly ...
5
votes
1answer
1k views

measures to take against a dns amplification attack

I recently discovered that my server was being used as part of a DNS DDOS. Basically, my BIND setup allowed recursion, and it was used to attack a certain IP address using IP spoofing. I took the ...
1
vote
2answers
885 views

Setting up fail2ban to ignore connections behind a dynamic IP

Using fail2ban to secure an Ubuntu 12.04 x64 Server on DigitalOcean, while editing /etc/fail2ban/jail.local there's this part: [DEFAULT] # "ignoreip" can be an IP address, a CIDR mask or a DNS host ...
1
vote
3answers
3k views

fail2ban Error Gentoo

I've recently setup a new VPS running Gentoo (My first time using the distro so please forgive me is this is a really easy one) and as I've done with other servers installed fail2ban. Setting it up to ...
3
votes
1answer
619 views

How to properly configure fail2ban to ban IP if it is accessing some wrong files

I am trying to configure fail2ban on my test server. I want just to temporary block any script bots that try to probe my site. So everything that has cgi-bin, admin, setup.php and so on. I previously ...
-1
votes
1answer
228 views

iptables: REJECT not working, but DROP does

I have recently setup a server with fail2ban, and it is mostly working except I am getting errors whenever this command tries to execute: sudo iptables -D fail2ban-ssh -s xxx.xxx.xxx.xxx -j REJECT ...
22
votes
6answers
45k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
9
votes
4answers
9k views

Permanent block of IP after n retries using fail2ban

I have a fail2ban configured like below: block the ip after 3 failed attempts release the IP after 300 sec timeout This works perfectly and I want to keep it this way such that a valid user gets a ...
5
votes
2answers
4k views

Custom fail2ban Filter for phpMyadmin bruteforce attempts

In my quest to block excessive failed phpMyAdmin login attempts with fail2ban, I've created a script that logs said failed attempts to a file: /var/log/phpmyadmin_auth.log Custom log The format of ...
2
votes
1answer
9k views

How To use fail2ban for Nginx? [closed]

How can I use fail2ban on an Nginx server? What are the rules to put in the jails.conf?
7
votes
4answers
12k views

In Fail2Ban, How to Change the SSH port number?

In my server, the ssh port is not the standard 22. I have set a different one. If I setup fail2ban, will it be able to detect that port? How can I tell it to check that port rather than port 22? The ...
3
votes
4answers
795 views

Sharing of fail2ban banned IPs

I'm using fail2ban on all servers with publicly visible services and I wonder: Is there an easy way to share banned IPs between hosts I control? Is there a service out there collecting and ...
3
votes
3answers
761 views

fail2ban bans me after a series of *successful* logins

I created a passwordless ssh login for one of my servers by using the authorized_keys file. The server has fail2ban on it, and I noticed that after several successful logins I could no longer log in ...
3
votes
4answers
516 views

Protect ssh server

I've got a debian-machine running several services, like apache with http and https, jabber and an openssh server for administration. The ssh-server is not running on port 22. It's on something like ...
4
votes
3answers
4k views

fail2ban not working on fresh install of ubuntu 14.04, why?

After installing and configuring fail2ban, I tried to login to my server through ssh with a wrong password. After a few attempts, I tried with the correct password with success. So, fail2ban didn't ...
4
votes
6answers
3k views

fail2ban and denyhosts constantly ban me on Ubuntu

I just got an Ubuntu instance on Linode. To secure the SSH on it, I installed fail2ban (using apt-get), but then had a problem: fail2ban kept banning my IP (for limited durations, thankfully) even ...
2
votes
3answers
2k views

Fail2Ban on CentOS 6.5 Never Bans

Environment: *CentOS 6.5 *Fail2Ban 0.8.14-1 *date outputs the correct date Behavior: Fail2ban starts successfully, but does not create iptables blocks after bad SSH login attempts. I'm only concerned ...
2
votes
3answers
3k views

Why isn't fail2ban blocking failures?

This below is the output of fail2ban log. Nothing more shows up, but in auth.log I see like hundreds of failures for root user login (someone is bad ass brute forcing). 2011-07-06 01:48:16,249 ...