Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

4
votes
1answer
517 views

How to blacklist or whitelist lots or few ip ranges with ipset and iptables + fail2ban

EDIT: It's astonishing how the urge to find a solution sometimes is sufficient to slowly but steadily lead one towards a solution. Also, the more often I reread my question in order to clarify it, I ...
2
votes
1answer
301 views

fail2ban jail not working properly

I'm trying to block non-available script requests to nginx with fail2ban. # Noscript filter /etc/fail2ban/filter.d/nginx-noscript.conf: # # Block IPs trying to execute scripts such as .php, .pl, ...
1
vote
1answer
24 views

how to configure `sshd_config` so fail2ban can see bots

I've updated my sshd_config to be more strict against bots. namely: only keys are allowed, except for a few specified users on specific ips MaxAuthTries = 1 no root login This has been both good ...
4
votes
0answers
1k views

Fail2Ban Correctly Attempts to Ban IP but IP does not get banned - iptables chain exists but not working

Running on Ubuntu 14.04 Server. So I have fail2ban correctly configured to process /var/log/auth.log for SSH login attempts. Upon 3 failed attempts I see this in the fail2ban log: 2014-11-19 ...
2
votes
0answers
164 views

“Centralized” fail2ban only banning attacks to local host

I'm trying to run fail2ban on the rsyslog server that gathers auth logs from the rest of our servers. I'm interested on getting notifications working as a first step. My problem is that fail2ban only ...
2
votes
0answers
88 views

Blocking bot by multi url pattern with fail2ban

I'm seeing a multi url pattern similar to following lines in nginx logs recently. GET / GET /somepath/ GET /otherpath/ GET / GET /somepath/ GET /otherpath/ ... I'm already using fail2ban for ...
1
vote
0answers
51 views

Fail2ban floods and slow response time

I tried searching for this; I found many people asking but I wasn't successfully to find a working (for me) solution. I have an application that logs each connection on a custom log file. When ...
1
vote
0answers
33 views

How do I specify multiple logfiles for a jail in fail2ban?

Heyo, I'm using Ubuntu 15.10 and fail2ban 0.9.3. Apache is set up with a bunch of Apache virtualhosts. I have my Apache2 logfiles located in subdirectories, one per localhost, e.g. ...
1
vote
0answers
97 views

How to detect SMTP AUTH attempts in Fail2Ban?

I have a Fail2Ban jail that monitors failed SASL authentications to my Postfix SMTP server. When this occurs, /var/log/mail.log contains these three lines: postfix/smtpd[32591]: connect from ...
1
vote
0answers
39 views

How do I set Host Groups on Fail2ban for Wordpress?

I'm trying to set up a custom filter for fail2ban on a wordpress site. I've been following this tutorial but when I try to test my custom filter, I get the error: server.failregex.RegexException: No ...
1
vote
0answers
10 views

Anomalous iptables entry with fail2ban (is it misconfigured to block outward traffic?)

Overall we are very satisfied with fail2ban as it has accumulated several dozen neverdowell IP addresses in our iptables rules. However I notice the following rule has also appeared: Chain ...
1
vote
0answers
107 views

Fail2Ban regex in sshd.conf not catching failed root logins in /var/log/auth.log

I used Fail2Ban on my Ubuntu server (14.04 LTS), and it mostly works well. I recently noticed the default regex in /etc/fail2ban/filter.d/sshd.conf does not match some failed sshd login attempts. ...
1
vote
0answers
37 views

Nginx: Logging 403's from proxies

So our server setup goes like this: www <-> nginx <-> backend services The internal services require authorisation, which often fails with a 403 if a user's token is incorrect and so ...
1
vote
0answers
86 views

Selinux: Shorewall will not respond to fail2ban

I am using fail2ban with shorewall and my Fedora 21 server & cloud. All flooded with the following error message: SELinux is preventing shorewall from write access on the file ...
1
vote
0answers
208 views

What this error means on Fail2ban?

I've installed fail2ban on my server. Anyway, I've seen this error on Fail2ban Log... What does it means? Here's the error 2015-02-09 06:11:21,076 fail2ban.filter [23563]: INFO ...
1
vote
0answers
230 views

Apache blocking based on combination of ip, request and useragent - Can fail2ban do that?

3 times over the past 48 hours, we had about a 6X spike in traffic lasting a few hours. The server handled it each time, but just barely. This was almost all bad-bot traffic (or maybe failed DOS ...
1
vote
0answers
193 views

Is fail2ban working?

I recently installed 2 new servers with Centos 7. I have enabled fail2ban with defaults. I have ensured it is running as ps -ax | grep fail2ban yields: 1996 ? S 0:04 /usr/bin/python ...
1
vote
0answers
197 views

What does Nginx Proxy Filter in Fail2ban really do?

What does Nginx Proxy Filter in Fail2ban really do? I am currently setting up Fail2Ban for Nginx. Almost everywhere I've read, they all have included a setting for [nginx-proxy] proxy filter. From ...
1
vote
0answers
357 views

How to protect tomcat application - user authentication with fail2ban?

AFAIK tomcat6 does not use Apache std .htaccess auth, but has own user authentication method. My question is: How to protect it against brute force attack with fail2ban ?
1
vote
0answers
658 views

Blocking X-forwarded-For IP in fail2ban?

I am using a reverse proxy in front of my web-server. In the web server I installed fail2ban and want to use it to monitor logs and block bad ip. I am using nginx with the http realip module. But ...
1
vote
0answers
224 views

nginx with fail2ban and mod_security

I forgot to update my fail2ban config for nginx. I just moved to nginx from apache. Today, I got a lot of cals from a single IP. IP tried to access login pages with post and get methods IP tried to ...
1
vote
0answers
469 views

How to Exclude Log Using Fail2Ban logpath with Wildcard Settings

I'm using wildcard in the logpath value as shown below: [http-get-dos] enabled = true filter = http-get-dos logpath = /var/log/ispconfig/httpd/*/access.log maxretry = 250 findtime = 300 #ban for 10 ...
1
vote
0answers
147 views

Fail2ban on Ubuntu 11.10 does not ban custom filter/jail

An application I'm running logs incorrect logins such as this: Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 ...
0
votes
0answers
7 views

Fail2ban error 'database is locked' when trying to start / restart it

I am currently reinstalling fail2ban to have a fresh version, because i've modified it quite a lot of time since I installed it for the first time, and I wanted to default settings for it. Once ...
0
votes
0answers
8 views

activate geoip settings when certain locations detected

I have a website that is attacked from time to time by ddos attackers. Such attack can disable the webpage for days. The webpage serves for few countries so if I know about the attack, the solution is ...
0
votes
0answers
8 views

fail2ban is interpolating invalid brackets for jail name

I have a fail2ban action with an actioncheck definition like so: actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name> This is part of a repeat offenders script I found, and ...
0
votes
0answers
20 views

fail2ban jail not working

I am struggling to get a single jail working in fail2ban. Fail2ban seems functional, and other jails are working. I have tried using fail2ban-regexp and it seems to be matching multiple times, but ...
0
votes
0answers
20 views

Can fail2ban detect and block IP-ranges?

Every day I get hundreds of this lines in my mail.log: Apr 28 11:10:28 servername amavis[30077]: (30077-08) Blocked SPAM {DiscardedInbound,Quarantined}, [185.140.110.16] <xxx@yyy.com> -> ...
0
votes
0answers
25 views

Having trouble getting correct information from Motion camera streaming server for fail2ban

I have a camera running a Motion streaming server, which uses simple HTTP md5 authentication, tunneled through stunnel on the server side. I'm using like to have fail2ban limit requests just for ...
0
votes
0answers
21 views

fail2ban: regex to block \x00 requests?

Every once in a while my server goes down, and when I check my nginx logs, I usually see something like this: 78.37.54.31 - - [20/Apr/2016:20:58:51 +0300] ...
0
votes
0answers
25 views

Fail2Ban WordPress filter not working on Debian VPS

I am having trouble getting WordPress Fail2Ban filter to work. I have installed the WP Fail2Ban plugin using the latest update which had a few changes, however, nothing is getting blocked. Here is a ...
0
votes
0answers
34 views

fail2ban regex correctly write

Sorry for my bad english. Server nginx. Block /administrator/ http_access_module nginx-error.log [error] 10934#0: *11435 access forbidden by rule, client: 213.87.x.x, server: localhost, request: ...
0
votes
0answers
19 views

fail2ban error: “WARNING Too much read error. Set the jail idle”

I get this error after a few days and it renders the fail2ban to ignore attacks on the specific filter: 2016-03-11 17:06:35,686 fail2ban.filter : ERROR Unable to get stat on ...
0
votes
0answers
25 views

Fail2ban fails to start when setting an action

After installing fail2ban and modifying its configuration it fails to start whenever i set the action to anything... here is the error, but note that $(action_mwl)s can will be diferent for any ...
0
votes
0answers
14 views

Fail2Ban bans all ports/protocols instead of specific port(s)

My jail.local: [siplimit-ban] findtime = 300 enabled = true filter = siplimit protocol = udp logpath = /var/log/syslog maxretry = 15 bantime = 3600 port = 5060,5061 And my iptables after ...
0
votes
0answers
19 views

Optimizing log file size on Ubuntu VM

This is a fact-finding question. I'm implementing fail2ban to keep some unscrupulous elements out of my Django website's experience. Note that my webserver is nginx (reverse proxy) with gunicorn as ...
0
votes
0answers
37 views

fail2ban doesnt read log if file being used

My environment is Ubuntu 14.04, LAMP stack all from apt. implemented fail2ban and configured jail.local with backend = auto [ssh] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log ...
0
votes
0answers
83 views

Issue with Fail2ban and Mikrotik Firewall

OS: CentOS 7.1 At my organization we are currently assessing using Fail2ban with the firewall on our Mikrotik router. I want Fail2ban to communicate any IP flagged as banned to the Mikrotik ...
0
votes
0answers
37 views

Nagios check_log reset to OK after notification

Fail2ban is installed on one of the servers, I'm able to ban every IP that try to log in. I'm using the check_log plugin of Nagios to capture the last line of the fail2ban.log, it compares to the ...
0
votes
0answers
18 views

Linking fail2ban with a RDBMS

I would like to maintain a highly dynamic RDBMS table that will be insert/update/deleted from from multiple hosts (a kind of global blacklist for all my servers). The table would have a couple basic ...
0
votes
0answers
19 views

Cannot get fail2ban failregex to match log

This is the failregex ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s ...
0
votes
0answers
51 views

Fail2Ban emails not showing extracts from Apache logfiles

I have recently set up Debian Jessie on a server for the first time. 'Obviously' fail2ban was set up very early in the process. It is banning IP addresses and sending me emails ok, but the ...
0
votes
0answers
166 views

Fail2Ban Cannot Read NginX Log Files - SELinux - ERROR No file(s) found for glob

I've been having issues with this on and off and I've exhausted my abilities on this. It's a CentOS7 system with SElinux enabled. Fail2Ban works for most jails just fine, very happy with it. My ...
0
votes
0answers
309 views

Trouble figuring out a fail2ban log error message: “iptables -n -L INPUT | grep -q 'fail2ban-SSH[ \t]' returned 100”

Here is my jail.local rule for ssh: [ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] logpath = /var/log/messages maxretry = 5 Here is what my ...
0
votes
0answers
65 views

Fail2ban not unbanning ip from jail

I've tried finding a way to unban an IP from fail2ban, but no matter what I do it seems to stay banned. I recently ran fail2ban-client get ssh actionunban myip and I do not get an error message, but ...
0
votes
0answers
43 views

fail2ban stops logging after some time (3-4 days)

I've noticed that whenever I want to see fail2ban logs after 3 or 4 days of being working, it compresses the logs to .gz which Im fine with that: -rw-r--r--. 1 root root 90034 May 1 12:49 ...
0
votes
0answers
233 views

prevent phpbb bruteforcing with mod_security

Update: I edited this and added a fail2ban tag. Perhaps that might be another way to handle this issue. I'm running phpbb 3.0.13-PL1 and I would like to protect the login page from bruteforcing. I'm ...
0
votes
0answers
110 views

fail2ban WARNING invalid command on apache2 disabled websites

I have a problem on a Debian Squeezy webserver running fail2ban. Now and then, fail2ban stops working complaining of missing access.log: fail2ban.comm : WARNING Invalid command: ['set', ...
0
votes
0answers
425 views

Fail2Ban Apache-noscript failing to block script as referer

I am receiving a number of apache not found or unable to stat and would like to block these IP addresses using Fail2Ban. [Fri Feb 28 03:36:51.816955 2014] [:error] [pid 29027] [client ...
-1
votes
0answers
20 views

fail2ban - ban ips accessing non-existing urls too often

would it be possible and good idea to ban for certain amount of time, ips that try to call non-existing urls fequently? This is a performance problem for my system - drupal, as it avoids caching. ...