Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

0
votes
2answers
195 views

Updating Hardware Firewall Rules From Fail2Ban?

I am a sysadmin and I was wondering if its possible to script or ideally use a built in feature to update a hardware firewall banned IP list from rules generated by fail2ban. I have done a bit of ...
1
vote
1answer
76 views

fail2ban jail not working properly

I'm trying to block non-available script requests to nginx with fail2ban. # Noscript filter /etc/fail2ban/filter.d/nginx-noscript.conf: # # Block IPs trying to execute scripts such as .php, .pl, ...
0
votes
1answer
250 views

Postfix fail2ban help.. I have a bad host but fail2ban won't block him

Hi I am using postfix plus fail2ban on Centos 6.5 but I am getting botted (I am not relaying but there you go) and for some reason fail2ban isn't able to cut the ip and block it this is 6/7 times a ...
0
votes
1answer
105 views

Fail2Ban Testing

Running the following testing script to see if Fail2ban is working: fail2ban-regex /var/log/apache*/*access.log /etc/fail2ban/filter.d/apache-auth.conf I get this response: Running tests ...
0
votes
1answer
169 views

Fail2ban won't start via /etc/init.d/fail2ban but will via /usr/bin/fail2ban-client

I've been running fail2ban successfully for a long time on RHEL. Now all of a sudden starting, stopping and restarting via /etc/init.d/fail2ban no longer works: # /etc/init.d/fail2ban start Starting ...
0
votes
1answer
111 views

Fail2ban restarts every day

In my server I can see that the fail2ban restarts every day. While checking the internet I can see that the logrotate causes this. I have disabled the logrotate of fail2ban by removing the fail2ban ...
0
votes
1answer
83 views

fail2ban receiving events but not triggering event

I have setup fail2ban to monitor a service which I have exposed outside my router. The files are being logged properly, and the events are being picked up by fail2ban 2013-11-21 01:05:24,573 ...
0
votes
1answer
405 views

Why fail2ban 0.8 doesn't start properly on Debain 7 Wheezy x64?

Why fail2ban 0.8 doesn't start properly on Debain 7 Wheezy x64? Hi, I'm trying to configure fail2ban to work with APF. But first, it would be great if fail2ban can start. root@akdom:/var/log# ...
0
votes
1answer
119 views

fail2ban block retry count always changes

As title mentions clearly, fail2ban block retry count always changes. I set all retry counts to 3; but sometimes it blocks me after 6 or 7 retries. How can set its behavior a constant value? I added ...
0
votes
1answer
282 views

fail2ban Service Crashing

I have a miss behaving fail2ban service on a very much live server. It'll tally up to 100% cpu usage after boot for about 30min then goes down to a stable 0.1% It freakin me out, something is crashing ...
2
votes
0answers
181 views

fail2ban fails to block from auth.log with directadmin

i'm using directadmin on a Ubuntu server. i recently installed Fail2Ban. but i'm still recieving "Brute-Force attack" email from directadmin. my jail.conf (only the auth.log jails!): [ssh] enabled ...
1
vote
0answers
45 views

How to use so called action variables in fail2ban?

I've seen a few mentions of these in the docs and misc scripts, but nothing concrete on exactly how they are used. Could anyone give me some examples? Is it just a case of myvar=7 . . . [ssh] ...
1
vote
0answers
99 views

nginx with fail2ban and mod_security

I forgot to update my fail2ban config for nginx. I just moved to nginx from apache. Today, I got a lot of cals from a single IP. IP tried to access login pages with post and get methods IP tried to ...
1
vote
0answers
126 views

How to Exclude Log Using Fail2Ban logpath with Wildcard Settings

I'm using wildcard in the logpath value as shown below: [http-get-dos] enabled = true filter = http-get-dos logpath = /var/log/ispconfig/httpd/*/access.log maxretry = 250 findtime = 300 #ban for 10 ...
1
vote
0answers
100 views

Fail2ban on Ubuntu 11.10 does not ban custom filter/jail

An application I'm running logs incorrect logins such as this: Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 ...
0
votes
0answers
80 views

Fail2Ban Apache-noscript failing to block script as referer

I am receiving a number of apache not found or unable to stat and would like to block these IP addresses using Fail2Ban. [Fri Feb 28 03:36:51.816955 2014] [:error] [pid 29027] [client ...
0
votes
0answers
125 views

Blocking X-forwarded-For IP in fail2ban?

I am using a reverse proxy in front of my web-server. In the web server I installed fail2ban and want to use it to monitor logs and block bad ip. I am using nginx with the http realip module. But ...
0
votes
0answers
49 views

Using fail2ban for auth.log POSSIBLE BREAK-IN ATTEMPT!s when on VPN

I've been getting a bunch of reverse mapping checking getaddrinfo for some-long-domain.example.com [X.X.X.X] failed - POSSIBLE BREAK-IN ATTEMPT! on my personal server. It's not as if these ...
0
votes
0answers
135 views

Fail2ban configure to stop trying to use the server as a proxy

With reference from my question on Flood of traffic on port 25 I have tried to configure Fail2ban to stop trying to use the server as a proxy. In jail.conf, I have added below rule: [nginx-proxy] ...
0
votes
0answers
679 views

Fail2Ban + BIND to ban “DNS format error from X.X.X.X resolving something.com/MX for client Y.Y.Y.Y: invalid response” or not to ban?

Recently, the increased load on the DNS, to log a lot of records like this: 14-Aug-2013 17:14:22.834 resolver: notice: DNS format error from 204.13.160.143#53 resolving palactive.com/MX for ...
0
votes
0answers
335 views

fail2ban is failing to ban apache IP pattern

I just noticed that fail2ban reports it 'banned' an IP address doing the following: 183.60.48.25 - - [03/Jul/2013:10:14:26 -0700] "GET http://www.baidu.com/ HTTP/1.1" 200 5112 183.60.48.25 - - ...
0
votes
0answers
559 views

How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?

Fail2Ban on Ubuntu 10.04 Configuration files /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1 bantime = 10 # made for test purposes maxretry = 3 backend = polling destemail = ...
0
votes
0answers
259 views

How to protect Nginx from HULK DoS tool

There is a tool called HULK (Http Unbearable Load King). It's a web server denial of service tool. It is designed to generate volumes of unique and obfuscated traffic at a webserver, bypassing caching ...
0
votes
0answers
166 views

Fail2ban fails to parse logs, no error, no warning, no banning on CentOS

Using latest build (0.8.8) on CentOS i've setup fail2ban to filter Kerio spam/harvest attacks. Here's my kerio.conf [INCLUDES] before = common.conf [Definition] failregex = .*SMTP connection from ...