Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

learn more… | top users | synonyms

0
votes
2answers
1k views

Why fail2ban 0.8 doesn't start properly on Debain 7 Wheezy x64?

Why fail2ban 0.8 doesn't start properly on Debain 7 Wheezy x64? Hi, I'm trying to configure fail2ban to work with APF. But first, it would be great if fail2ban can start. root@akdom:/var/log# ...
0
votes
2answers
300 views

Updating Hardware Firewall Rules From Fail2Ban?

I am a sysadmin and I was wondering if its possible to script or ideally use a built in feature to update a hardware firewall banned IP list from rules generated by fail2ban. I have done a bit of ...
1
vote
1answer
298 views

Fail2ban configuration for nginx using firewallcmd in CentOS 7

Previously I have a CentOS 6.5 with Iptables and I configure some jails for nginx as suggested here: How To use fail2ban for Nginx?. But now I am in CentOS 7, trying to use the new firewall and ...
1
vote
1answer
260 views

Fail2ban on centos 7 does not add rule to firewall. Firewall-cmd used on system

I installed the latest fail2ban from centos/epel I have added the ssh enabled option in jail.local. I have tried with action and banaction = firewallcmd-ipset neither made any difference. ...
1
vote
1answer
195 views

fail2ban jail not working properly

I'm trying to block non-available script requests to nginx with fail2ban. # Noscript filter /etc/fail2ban/filter.d/nginx-noscript.conf: # # Block IPs trying to execute scripts such as .php, .pl, ...
0
votes
1answer
151 views

ipTables IP Range will not be blocked

I have setup fail2ban with this Tutorial http://wireflare.com/permanently-ban-repeat-offenders-with-fail2ban/ and it seems working. But the attackers are changing their IPs and thats why I decided to ...
0
votes
1answer
205 views

Configuring varnish to write an apache error log with IP addresses

I am in the process of installing fail2ban on a webserver which runs Varnish. Many on the 'jails' require access to the apache/php error logs. One of the problems I have is that all of the refernces ...
0
votes
1answer
270 views

Writing a fail2ban multiline regex

I've got some troublesome hosts trying it on with an SSH server I run, and I'm trying to ban them using fail2ban. Problem is, I haven't done much work with regexes, and even less with Python regexes. ...
0
votes
1answer
205 views

Fail2ban does not ban any ip-adresses with vsftpd

Fail2ban starts okey. It work with my sshd filter and bans IP-adresses as it should. But with vsftpd it does not register failed logins when I run: fail2ban-client status vsftpd I have tried both ...
0
votes
1answer
120 views

Brute force attacks with server's IP

I am running a Debian wheezy server with fail2ban installed, everything works as expected but recently my own server got banned. I added the server's IP in the exception row and it seems to work, but ...
0
votes
1answer
424 views

Fail2ban restarts every day

In my server I can see that the fail2ban restarts every day. While checking the internet I can see that the logrotate causes this. I have disabled the logrotate of fail2ban by removing the fail2ban ...
0
votes
1answer
130 views

fail2ban receiving events but not triggering event

I have setup fail2ban to monitor a service which I have exposed outside my router. The files are being logged properly, and the events are being picked up by fail2ban 2013-11-21 01:05:24,573 ...
0
votes
1answer
258 views

fail2ban block retry count always changes

As title mentions clearly, fail2ban block retry count always changes. I set all retry counts to 3; but sometimes it blocks me after 6 or 7 retries. How can set its behavior a constant value? I added ...
0
votes
1answer
1k views

How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?

Fail2Ban on Ubuntu 10.04 Configuration files /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1 bantime = 10 # made for test purposes maxretry = 3 backend = polling destemail = ...
0
votes
1answer
410 views

fail2ban Service Crashing

I have a miss behaving fail2ban service on a very much live server. It'll tally up to 100% cpu usage after boot for about 30min then goes down to a stable 0.1% It freakin me out, something is crashing ...
4
votes
0answers
156 views

How to blacklist or whitelist lots or few ip ranges with ipset and iptables + fail2ban

EDIT: It's astonishing how the urge to find a solution sometimes is sufficient to slowly but steadily lead one towards a solution. Also, the more often I reread my question in order to clarify it, I ...
2
votes
0answers
77 views

“Centralized” fail2ban only banning attacks to local host

I'm trying to run fail2ban on the rsyslog server that gathers auth logs from the rest of our servers. I'm interested on getting notifications working as a first step. My problem is that fail2ban only ...
2
votes
0answers
69 views

Blocking bot by multi url pattern with fail2ban

I'm seeing a multi url pattern similar to following lines in nginx logs recently. GET / GET /somepath/ GET /otherpath/ GET / GET /somepath/ GET /otherpath/ ... I'm already using fail2ban for ...
2
votes
0answers
452 views

fail2ban fails to block from auth.log with directadmin

i'm using directadmin on a Ubuntu server. i recently installed Fail2Ban. but i'm still recieving "Brute-Force attack" email from directadmin. my jail.conf (only the auth.log jails!): [ssh] enabled ...
1
vote
0answers
9 views

Nginx: Logging 403's from proxies

So our server setup goes like this: www <-> nginx <-> backend services The internal services require authorisation, which often fails with a 403 if a user's token is incorrect and so ...
1
vote
0answers
33 views

Selinux: Shorewall will not respond to fail2ban

I am using fail2ban with shorewall and my Fedora 21 server & cloud. All flooded with the following error message: SELinux is preventing shorewall from write access on the file ...
1
vote
0answers
101 views

What this error means on Fail2ban?

I've installed fail2ban on my server. Anyway, I've seen this error on Fail2ban Log... What does it means? Here's the error 2015-02-09 06:11:21,076 fail2ban.filter [23563]: INFO ...
1
vote
0answers
151 views

Apache blocking based on combination of ip, request and useragent - Can fail2ban do that?

3 times over the past 48 hours, we had about a 6X spike in traffic lasting a few hours. The server handled it each time, but just barely. This was almost all bad-bot traffic (or maybe failed DOS ...
1
vote
0answers
565 views

Fail2ban not banning IP's

Running a new install of OpenSuse 13.2 (Running rsyslog) My jail.conf file contains: [ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] ...
1
vote
0answers
525 views

Fail2Ban Correctly Attempts to Ban IP but IP does not get banned - iptables chain exists but not working

Running on Ubuntu 14.04 Server. So I have fail2ban correctly configured to process /var/log/auth.log for SSH login attempts. Upon 3 failed attempts I see this in the fail2ban log: 2014-11-19 ...
1
vote
0answers
111 views

Is fail2ban working?

I recently installed 2 new servers with Centos 7. I have enabled fail2ban with defaults. I have ensured it is running as ps -ax | grep fail2ban yields: 1996 ? S 0:04 /usr/bin/python ...
1
vote
0answers
275 views

How to protect tomcat application - user authentication with fail2ban?

AFAIK tomcat6 does not use Apache std .htaccess auth, but has own user authentication method. My question is: How to protect it against brute force attack with fail2ban ?
1
vote
0answers
441 views

Blocking X-forwarded-For IP in fail2ban?

I am using a reverse proxy in front of my web-server. In the web server I installed fail2ban and want to use it to monitor logs and block bad ip. I am using nginx with the http realip module. But ...
1
vote
0answers
185 views

nginx with fail2ban and mod_security

I forgot to update my fail2ban config for nginx. I just moved to nginx from apache. Today, I got a lot of cals from a single IP. IP tried to access login pages with post and get methods IP tried to ...
1
vote
0answers
325 views

How to Exclude Log Using Fail2Ban logpath with Wildcard Settings

I'm using wildcard in the logpath value as shown below: [http-get-dos] enabled = true filter = http-get-dos logpath = /var/log/ispconfig/httpd/*/access.log maxretry = 250 findtime = 300 #ban for 10 ...
1
vote
0answers
128 views

Fail2ban on Ubuntu 11.10 does not ban custom filter/jail

An application I'm running logs incorrect logins such as this: Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 20:46:03 +0000 failed login from iphere ! Tue, 19 Mar 13 ...
0
votes
0answers
5 views

fail2ban couriertcpd: LOGIN FAILED not banning

My fail2ban is not banning as I expect. An example of my log entries are :- Jul 26 07:11:29 mail couriertcpd: LOGIN FAILED, user=sally, ip=[::ffff:54.191.110.169] Jul 26 07:13:22 mail couriertcpd: ...
0
votes
0answers
58 views

Trouble figuring out a fail2ban log error message: “iptables -n -L INPUT | grep -q 'fail2ban-SSH[ \t]' returned 100”

Here is my jail.local rule for ssh: [ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] logpath = /var/log/messages maxretry = 5 Here is what my ...
0
votes
0answers
41 views

fail2ban wont ban ssh from local hosts

I'm trying to configure fail2ban to block ssh from a local hosts. Fail2ban is install on CentOS 7 with firewall (Linux 3.10.0-229.4.2.el7.x86_64 x86_64 ). I have copied the jail.conf to jail.local i ...
0
votes
0answers
23 views

Fail2ban not unbanning ip from jail

I've tried finding a way to unban an IP from fail2ban, but no matter what I do it seems to stay banned. I recently ran fail2ban-client get ssh actionunban myip and I do not get an error message, but ...
0
votes
0answers
22 views

fail2ban stops logging after some time (3-4 days)

I've noticed that whenever I want to see fail2ban logs after 3 or 4 days of being working, it compresses the logs to .gz which Im fine with that: -rw-r--r--. 1 root root 90034 May 1 12:49 ...
0
votes
0answers
27 views

Make Fail2ban parse latest logs generated monthly.

I have a log file generated monthly (e.g messageApril2015.log,messageMay2015.log). Can anyone tell me how to make fail2ban parse the latest log? I have read somewhere about adding %F%Y but it didn't ...
0
votes
0answers
93 views

Can't pass Fail2ban banned IP's to CloudFlare in Nginx?

I have Ubuntu 14.04, Nginx 1.6.2, MySQL 10.0.17-MariaDB, PHP 5.5.24 VPS. It running two WordPress sites. I use fail2ban with CSF. Fail2ban I use ban action as route, because iptables-multiport and ...
0
votes
0answers
109 views

prevent phpbb bruteforcing with mod_security

Update: I edited this and added a fail2ban tag. Perhaps that might be another way to handle this issue. I'm running phpbb 3.0.13-PL1 and I would like to protect the login page from bruteforcing. I'm ...
0
votes
0answers
54 views

fail2ban WARNING invalid command on apache2 disabled websites

I have a problem on a Debian Squeezy webserver running fail2ban. Now and then, fail2ban stops working complaining of missing access.log: fail2ban.comm : WARNING Invalid command: ['set', ...
0
votes
0answers
62 views

Fail2ban apache-myadmin regex

I've got a jail set up with the following regex, which I took from a standard filter file: apache-myadmin.conf failregex = ^[[]client <HOST>[]] File does not exist: *myadmin* *\s*$ ...
0
votes
0answers
117 views

What does Nginx Proxy Filter in Fail2ban really do?

What does Nginx Proxy Filter in Fail2ban really do? I am currently setting up Fail2Ban for Nginx. Almost everywhere I've read, they all have included a setting for [nginx-proxy] proxy filter. From ...
0
votes
0answers
322 views

Fail2Ban Apache-noscript failing to block script as referer

I am receiving a number of apache not found or unable to stat and would like to block these IP addresses using Fail2Ban. [Fri Feb 28 03:36:51.816955 2014] [:error] [pid 29027] [client ...
0
votes
0answers
2k views

Fail2Ban + BIND to ban “DNS format error from X.X.X.X resolving something.com/MX for client Y.Y.Y.Y: invalid response” or not to ban?

Recently, the increased load on the DNS, to log a lot of records like this: 14-Aug-2013 17:14:22.834 resolver: notice: DNS format error from 204.13.160.143#53 resolving palactive.com/MX for ...
0
votes
0answers
411 views

fail2ban is failing to ban apache IP pattern

I just noticed that fail2ban reports it 'banned' an IP address doing the following: 183.60.48.25 - - [03/Jul/2013:10:14:26 -0700] "GET http://www.baidu.com/ HTTP/1.1" 200 5112 183.60.48.25 - - ...
0
votes
0answers
444 views

How to protect Nginx from HULK DoS tool

There is a tool called HULK (Http Unbearable Load King). It's a web server denial of service tool. It is designed to generate volumes of unique and obfuscated traffic at a webserver, bypassing caching ...
0
votes
0answers
278 views

Fail2ban fails to parse logs, no error, no warning, no banning on CentOS

Using latest build (0.8.8) on CentOS i've setup fail2ban to filter Kerio spam/harvest attacks. Here's my kerio.conf [INCLUDES] before = common.conf [Definition] failregex = .*SMTP connection from ...