Questions tagged [fail2ban]
Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.
722
questions
304
votes
17
answers
735k
views
How to Unban an IP properly with Fail2Ban
I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly.
I know I can work with IPTables directly: iptables -D fail2ban-ssh <number>
But is there not a way to do it with ...
121
votes
15
answers
533k
views
How to show all banned IP with fail2ban?
When I run this command fail2ban-client status sshd I got this:
Status for the jail: sshd
|- Filter
| |- Currently failed: 1
| |- Total failed: 81
| `- File list: /var/log/auth.log
`- ...
65
votes
11
answers
65k
views
Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?
I'm setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I've seen many recommendations for both denyhosts and fail2ban, but few comparisons of the two....
48
votes
6
answers
87k
views
Permanent block of IP after n retries using fail2ban
I have a fail2ban configured like below:
block the ip after 3 failed attempts
release the IP after 300 sec timeout
This works perfectly and I want to keep it this way such that a valid user gets a ...
39
votes
5
answers
84k
views
In Fail2Ban, How to Change the SSH port number?
In my server, the ssh port is not the standard 22. I have set a different one. If I setup fail2ban, will it be able to detect that port? How can I tell it to check that port rather than port 22?
The ...
33
votes
1
answer
38k
views
How to set up fail2ban to read multi log in a jail?
How can I configure multiple logpaths for the same rule?
I'm trying to write a syntax like this:
[apache-w00tw00t]
enabled = true
filter = apache-w00tw00t
action = iptables-allports
logpath = /...
32
votes
5
answers
21k
views
fail2ban's database is too large (over 500mb). How do I get it to a reasonable size?
Recently my backups have started failing, and I tracked the problem to the file /var/lib/fail2ban/fail2ban.sqlite3. It is over 500mb. I am not sure whether it has been growing over time or if this is ...
32
votes
1
answer
23k
views
Fail2ban jail.local vs jail.conf
Does jail.local file act as an override to jail.conf or as a replacement to jail.conf?
When I was learning about Fail2Ban from tutorials, most of them usually say either to copy jail.conf to jail....
26
votes
6
answers
14k
views
Sharing of fail2ban banned IPs
I'm using fail2ban on all servers with publicly visible services and I wonder:
Is there an easy way to share banned IPs between hosts I control?
Is there a service out there collecting and ...
24
votes
12
answers
27k
views
Fail2Ban: already banned?
I have Fail2Ban running on my Centos Server. (Config below)
In my var/log/messages I noticed something really weird:
Jun 19 12:09:32 localhost fail2ban.actions: INFO [postfix] 114.43.245.205 ...
20
votes
13
answers
38k
views
Stop fail2ban stop/start notifications
If the server is restarted, or even if fail2ban is stopped/start it sends a notification.
[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=...
16
votes
6
answers
16k
views
Modify fail2ban failregex to match failed public key authentications via ssh
fail2ban doesn't recognize failed public key ssh logins and I assume that this can be solved by modifying the failregex of /etc/fail2ban/filter.d/sshd.config to match the following line:
<date> ...
16
votes
3
answers
7k
views
Banning IPv6 addresses
I am currently accustomed to using tools like fail2ban to keep unwanted traffic away from my servers by banning IPv4 addresses: too many bad log entries per IP, ban the IP.
However when the world ...
15
votes
3
answers
28k
views
How do I setup monitoring of MySQL with Fail2ban?
Searching the internet with search engines on MySQL and fail2ban yields lots of results on putting your fail2ban logs into MySQL, however I'm wanting to monitor failed MySQL attempts to log in and ban ...
15
votes
3
answers
12k
views
Fail2Ban Correctly Attempts to Ban IP but IP does not get banned - iptables chain exists but not working
Running on Ubuntu 14.04 Server.
So I have fail2ban correctly configured to process /var/log/auth.log for SSH login attempts.
Upon 3 failed attempts I see this in the fail2ban log:
2014-11-19 15:...
14
votes
3
answers
19k
views
Installing from EPEL on Amazon EC2
I am trying to install fail2ban on our Amazon EC2 Linux AMI (CentOS). I know that fail2ban is in the EPEL so I have done the following:
wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-...
14
votes
5
answers
8k
views
Is it worth the effort to block failed login attempts
Is it worthwhile running fail2ban, sshdfilter or similar tools, which blacklist IP addresses which attempt and fail to login?
I've seen it argued that this is security theatre on a "properly secured"...
13
votes
2
answers
33k
views
Fail2Ban unblock ipaddress
I am trying to unblock an IP address without restarting Fail2Ban each time, what is the best way of doing this? Or can you point me in the direction of a useful guide?
As you can see below the IP ...
13
votes
1
answer
19k
views
How to test whether fail2ban can really send an email?
I have configured fail2ban but I would like to test sending of email.
For example, I would like that I get email when fail2ban is started or stopped.
12
votes
5
answers
7k
views
is fail2ban safe? Better to use ssh keys?
I'm in doubt if I should use key authentication when logging into SSH, or just go for fail2ban + ssh (root login disabled).
Is fail2ban safe or is it really better to just go ahead and generate keys ...
12
votes
1
answer
12k
views
Fail2Ban blocking behaviours depending on the status code
I am using Fail2Ban and I have configured it as needed. This is reading logs from nginx/error.log and is acting depending on configs about maxretry and timing sets. The question is that is this ...
12
votes
3
answers
24k
views
Why is iptables not blocking an ip address?
I have configured fail2ban to monitor a certain pattern of malicious traffic I'm getting and ban IP addresses associated.
Everything seems to be working great -- the regex is matching the pattern ...
12
votes
3
answers
16k
views
Fail2ban log filled with entries saying "fail2ban.filter : WARNING Determined IP using DNS Lookup:.."
My fail2ban log at /var/log/fail2ban.log is completely filled with entries saying:
fail2ban.filter : WARNING Determined IP using DNS Lookup: [IP address]
I think this may have begun after I changed ...
12
votes
3
answers
12k
views
How to block IPs that cause excessive 404 errors with Fail2ban?
I have installed Fail2Ban v0.10.2 on Ubuntu 18.04 with Apache 2.4.29 and enabled the standard ssh and apache jails for basic protection with email notification warnings, when an IP is blocked.
Having ...
11
votes
2
answers
27k
views
Why is fail2ban not banning this attack?
I have fail2ban installed to ban bruteforce attempts on the ssh password. There are business requirements for not disabling password authentication on this machine.
fail2ban was installed using the ...
11
votes
3
answers
6k
views
Does fail2ban monitor rotated log files?
Does fail2ban continue to monitor rotated log files?
For example, I have a rule monitoring /var/log/fail2ban.log which is automatically rotated by the system every week (7 days). I want to have a ...
10
votes
3
answers
6k
views
Securing linux servers: iptables vs fail2ban
I would like to pick the community's brain regarding linux server security, specifically regarding brute-force attacks and using fail2ban vs custom iptables.
There are a few similar questions out ...
10
votes
4
answers
10k
views
How to block all root login attempts using denyhosts and or fail2ban?
I currently block all ssh logins using root. But I wanted to go the extra mile and block the ip address of the client who tried to login as root. I currently have denyhosts and fail2ban setup and ...
10
votes
2
answers
25k
views
Custom fail2ban Filter for phpMyadmin bruteforce attempts
In my quest to block excessive failed phpMyAdmin login attempts with fail2ban, I've created a script that logs said failed attempts to a file: /var/log/phpmyadmin_auth.log
Custom log
The format of ...
10
votes
1
answer
9k
views
How to use so called action variables in fail2ban?
I've seen a few mentions of these in the docs and misc scripts, but nothing concrete on exactly how they are used. Could anyone give me some examples?
Is it just a case of
myvar=7
.
.
.
[ssh]
...
10
votes
2
answers
3k
views
How to *add* rules in local fail2ban filter definition?
I have installed fail2ban as packaged by Debian on a server under my control. Since I have some failregexes from before, I'm putting those into the local filter definition file so they will be ...
10
votes
3
answers
5k
views
Is there any reason to use fail2ban with SSH password logins disabled?
I am setting up an Ubuntu server hosted by Linode.
I am stepping through their security guide and they recommend installing fail2ban after disabling password based SSH logins.
I don't see the point ...
9
votes
2
answers
42k
views
How to check if firewalld is blocking an incoming ip address?
I have CentOS 7 with firewalld. I installed fail2ban and using the firewallcmd-new action. I am seeing bans in the fail2ban logs, and I want to check in firewallcmd if they are blocked. How can I do ...
9
votes
3
answers
7k
views
fail2ban blocks IP in ignoreip list
I'm using fail2ban and it continues to block an IP even after I have whitelisted that IP.
In /etc/fail2ban/jail.conf there is a line like the following one:
ignoreip = 53.45.114.103
However fail2ban ...
9
votes
1
answer
9k
views
Why is fail2ban finding but not banning
I noticed something strange on my Ubuntu Xenial server.
It has SSH on the default port and it has fail2ban.
Fail2ban is detecting brute force attempts on the server and are logged accordingly:
2017-...
8
votes
2
answers
20k
views
Get Fail2Ban To Check findtime Every X Minutes
I have fail2ban set up with the following settings:
bantime = 86400
findtime = 600
maxretry = 2
This is great as it stops any IPs who are brute forcing 3 times within 10 minutes. However, there ...
8
votes
5
answers
21k
views
ERROR Found no accessible config files for 'fail2ban' under /etc/fail2ban
So my fail2ban wasn't working and in attempts to make it work the config files got messy. Decided to start from scratch.
I ran these as sudo
apt-get remove fail2ban
apt-get purge fail2ban
rm -r /...
7
votes
1
answer
29k
views
Using fail2ban to manually block an ip for a specific time period
I'm noticing that brute force password crackers are becoming more sophisticated, learning the rate at which their IPs get banned, and slowing their intrusion attempts so as to not be caught by ...
7
votes
4
answers
10k
views
Permanently and persistently ban an IP with fail2ban
I have set up a custom jail for a spambot that is giving me trouble.
Using "bantime -1" I was trying to permanently ban the botnet. I thought it was working, but when the weekly logrotate occured ...
7
votes
1
answer
19k
views
How do I format this regex so it will work in fail2ban?
I've just installed fail2ban on my CentOS server in response to an SSH brute force attempt. The default regular expressions in fail2ban's sshd.conf file do not match any entries in audit.log, which ...
7
votes
1
answer
9k
views
fail2ban- How to whitelist a big list of IP address to the jail.local file
My CDN provider gives me a big list of IP to whitelist, I need to add them to the line of ignoreip = in jail.local.
The list of IP address provided is line by line with one line one IP address, but ...
7
votes
1
answer
36k
views
Fail2ban doesn't start [closed]
I've done some changes to the file /etc/fail2ban/jail.local (a copy of /etc/fail2ban/jail.conf) and saved, but now fail2ban doesn't start. If I erase jail.local, then it start again. So the problem is ...
7
votes
5
answers
10k
views
Do AWS Servers need fail2ban?
I saw that while I was creating my AWS instance I opted for only my IP address being able to access my server. Also There is a RSA key that is configured for you. In this case do I really need ...
7
votes
1
answer
3k
views
How to properly configure fail2ban to ban IP if it is accessing some wrong files
I am trying to configure fail2ban on my test server. I want just to temporary block any script bots that try to probe my site. So everything that has cgi-bin, admin, setup.php and so on. I previously ...
7
votes
1
answer
3k
views
measures to take against a dns amplification attack
I recently discovered that my server was being used as part of a DNS DDOS. Basically, my BIND setup allowed recursion, and it was used to attack a certain IP address using IP spoofing.
I took the ...
6
votes
4
answers
15k
views
fail2ban not working on fresh install of ubuntu 14.04, why?
After installing and configuring fail2ban, I tried to login to my server through ssh with a wrong password. After a few attempts, I tried with the correct password with success. So, fail2ban didn't ...
6
votes
1
answer
9k
views
Fail2Ban: what is apache-overflows?
I am trying to configure fail2ban for my server and have come across: apache-overflows in the .config
What does it do/protect against?
6
votes
1
answer
22k
views
fail2ban for windows 2008 RDP [duplicate]
I'm looking for a solution to make remote desktop more secure.
I'm looking for a fail2ban like for windows and specially for RDP which will block IP in firewall after N failed retries
Any help?
6
votes
6
answers
5k
views
fail2ban and denyhosts constantly ban me on Ubuntu
I just got an Ubuntu instance on Linode. To secure the SSH on it, I installed fail2ban (using apt-get), but then had a problem: fail2ban kept banning my IP (for limited durations, thankfully) even ...
6
votes
2
answers
3k
views
Should i use Firewalld or Iptables for Fail2ban in Centos 7?
I'm setting up Fail2ban to protect ssh, and I use firewalld,
I saw a lot of people recommending to use anaction = iptables-multiport
and other solutions using iptables instead of firewalld claiming ...