Questions tagged [fail2ban]

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

Filter by
Sorted by
Tagged with
304 votes
17 answers
735k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
psp's user avatar
  • 3,303
121 votes
15 answers
533k views

How to show all banned IP with fail2ban?

When I run this command fail2ban-client status sshd I got this: Status for the jail: sshd |- Filter | |- Currently failed: 1 | |- Total failed: 81 | `- File list: /var/log/auth.log `- ...
Dark Cyber's user avatar
  • 1,319
65 votes
11 answers
65k views

Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

I'm setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I've seen many recommendations for both denyhosts and fail2ban, but few comparisons of the two....
spiffytech's user avatar
  • 1,093
48 votes
6 answers
87k views

Permanent block of IP after n retries using fail2ban

I have a fail2ban configured like below: block the ip after 3 failed attempts release the IP after 300 sec timeout This works perfectly and I want to keep it this way such that a valid user gets a ...
BTR Naidu's user avatar
  • 627
39 votes
5 answers
84k views

In Fail2Ban, How to Change the SSH port number?

In my server, the ssh port is not the standard 22. I have set a different one. If I setup fail2ban, will it be able to detect that port? How can I tell it to check that port rather than port 22? The ...
THpubs's user avatar
  • 1,775
33 votes
1 answer
38k views

How to set up fail2ban to read multi log in a jail?

How can I configure multiple logpaths for the same rule? I'm trying to write a syntax like this: [apache-w00tw00t] enabled = true filter = apache-w00tw00t action = iptables-allports logpath = /...
Max121's user avatar
  • 353
32 votes
5 answers
21k views

fail2ban's database is too large (over 500mb). How do I get it to a reasonable size?

Recently my backups have started failing, and I tracked the problem to the file /var/lib/fail2ban/fail2ban.sqlite3. It is over 500mb. I am not sure whether it has been growing over time or if this is ...
felwithe's user avatar
  • 866
32 votes
1 answer
23k views

Fail2ban jail.local vs jail.conf

Does jail.local file act as an override to jail.conf or as a replacement to jail.conf? When I was learning about Fail2Ban from tutorials, most of them usually say either to copy jail.conf to jail....
Neel's user avatar
  • 1,471
26 votes
6 answers
14k views

Sharing of fail2ban banned IPs

I'm using fail2ban on all servers with publicly visible services and I wonder: Is there an easy way to share banned IPs between hosts I control? Is there a service out there collecting and ...
ndemou's user avatar
  • 1,365
24 votes
12 answers
27k views

Fail2Ban: already banned?

I have Fail2Ban running on my Centos Server. (Config below) In my var/log/messages I noticed something really weird: Jun 19 12:09:32 localhost fail2ban.actions: INFO [postfix] 114.43.245.205 ...
3und80's user avatar
  • 353
20 votes
13 answers
38k views

Stop fail2ban stop/start notifications

If the server is restarted, or even if fail2ban is stopped/start it sends a notification. [asterisk-iptables] enabled = true filter = asterisk action = iptables-allports[name=ASTERISK, protocol=...
Michael's user avatar
  • 343
16 votes
6 answers
16k views

Modify fail2ban failregex to match failed public key authentications via ssh

fail2ban doesn't recognize failed public key ssh logins and I assume that this can be solved by modifying the failregex of /etc/fail2ban/filter.d/sshd.config to match the following line: <date> ...
apoc's user avatar
  • 263
16 votes
3 answers
7k views

Banning IPv6 addresses

I am currently accustomed to using tools like fail2ban to keep unwanted traffic away from my servers by banning IPv4 addresses: too many bad log entries per IP, ban the IP. However when the world ...
Mikko Ohtamaa's user avatar
15 votes
3 answers
28k views

How do I setup monitoring of MySQL with Fail2ban?

Searching the internet with search engines on MySQL and fail2ban yields lots of results on putting your fail2ban logs into MySQL, however I'm wanting to monitor failed MySQL attempts to log in and ban ...
InvisibleFrisbee's user avatar
15 votes
3 answers
12k views

Fail2Ban Correctly Attempts to Ban IP but IP does not get banned - iptables chain exists but not working

Running on Ubuntu 14.04 Server. So I have fail2ban correctly configured to process /var/log/auth.log for SSH login attempts. Upon 3 failed attempts I see this in the fail2ban log: 2014-11-19 15:...
Halsafar's user avatar
  • 271
14 votes
3 answers
19k views

Installing from EPEL on Amazon EC2

I am trying to install fail2ban on our Amazon EC2 Linux AMI (CentOS). I know that fail2ban is in the EPEL so I have done the following: wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-...
williamsdb's user avatar
14 votes
5 answers
8k views

Is it worth the effort to block failed login attempts

Is it worthwhile running fail2ban, sshdfilter or similar tools, which blacklist IP addresses which attempt and fail to login? I've seen it argued that this is security theatre on a "properly secured"...
dunxd's user avatar
  • 9,704
13 votes
2 answers
33k views

Fail2Ban unblock ipaddress

I am trying to unblock an IP address without restarting Fail2Ban each time, what is the best way of doing this? Or can you point me in the direction of a useful guide? As you can see below the IP ...
John Magnolia's user avatar
13 votes
1 answer
19k views

How to test whether fail2ban can really send an email?

I have configured fail2ban but I would like to test sending of email. For example, I would like that I get email when fail2ban is started or stopped.
user84686's user avatar
  • 281
12 votes
5 answers
7k views

is fail2ban safe? Better to use ssh keys?

I'm in doubt if I should use key authentication when logging into SSH, or just go for fail2ban + ssh (root login disabled). Is fail2ban safe or is it really better to just go ahead and generate keys ...
solsol's user avatar
  • 1,131
12 votes
1 answer
12k views

Fail2Ban blocking behaviours depending on the status code

I am using Fail2Ban and I have configured it as needed. This is reading logs from nginx/error.log and is acting depending on configs about maxretry and timing sets. The question is that is this ...
Parsa Samet's user avatar
12 votes
3 answers
24k views

Why is iptables not blocking an ip address?

I have configured fail2ban to monitor a certain pattern of malicious traffic I'm getting and ban IP addresses associated. Everything seems to be working great -- the regex is matching the pattern ...
jsdalton's user avatar
  • 223
12 votes
3 answers
16k views

Fail2ban log filled with entries saying "fail2ban.filter : WARNING Determined IP using DNS Lookup:.."

My fail2ban log at /var/log/fail2ban.log is completely filled with entries saying: fail2ban.filter : WARNING Determined IP using DNS Lookup: [IP address] I think this may have begun after I changed ...
Dirk Calloway's user avatar
12 votes
3 answers
12k views

How to block IPs that cause excessive 404 errors with Fail2ban?

I have installed Fail2Ban v0.10.2 on Ubuntu 18.04 with Apache 2.4.29 and enabled the standard ssh and apache jails for basic protection with email notification warnings, when an IP is blocked. Having ...
user avatar
11 votes
2 answers
27k views

Why is fail2ban not banning this attack?

I have fail2ban installed to ban bruteforce attempts on the ssh password. There are business requirements for not disabling password authentication on this machine. fail2ban was installed using the ...
Leo's user avatar
  • 983
11 votes
3 answers
6k views

Does fail2ban monitor rotated log files?

Does fail2ban continue to monitor rotated log files? For example, I have a rule monitoring /var/log/fail2ban.log which is automatically rotated by the system every week (7 days). I want to have a ...
J. Chin's user avatar
  • 615
10 votes
3 answers
6k views

Securing linux servers: iptables vs fail2ban

I would like to pick the community's brain regarding linux server security, specifically regarding brute-force attacks and using fail2ban vs custom iptables. There are a few similar questions out ...
kingmilo's user avatar
  • 211
10 votes
4 answers
10k views

How to block all root login attempts using denyhosts and or fail2ban?

I currently block all ssh logins using root. But I wanted to go the extra mile and block the ip address of the client who tried to login as root. I currently have denyhosts and fail2ban setup and ...
samwell's user avatar
  • 339
10 votes
2 answers
25k views

Custom fail2ban Filter for phpMyadmin bruteforce attempts

In my quest to block excessive failed phpMyAdmin login attempts with fail2ban, I've created a script that logs said failed attempts to a file: /var/log/phpmyadmin_auth.log Custom log The format of ...
Michael Robinson's user avatar
10 votes
1 answer
9k views

How to use so called action variables in fail2ban?

I've seen a few mentions of these in the docs and misc scripts, but nothing concrete on exactly how they are used. Could anyone give me some examples? Is it just a case of myvar=7 . . . [ssh] ...
fpghost's user avatar
  • 693
10 votes
2 answers
3k views

How to *add* rules in local fail2ban filter definition?

I have installed fail2ban as packaged by Debian on a server under my control. Since I have some failregexes from before, I'm putting those into the local filter definition file so they will be ...
user's user avatar
  • 4,445
10 votes
3 answers
5k views

Is there any reason to use fail2ban with SSH password logins disabled?

I am setting up an Ubuntu server hosted by Linode. I am stepping through their security guide and they recommend installing fail2ban after disabling password based SSH logins. I don't see the point ...
dbasch's user avatar
  • 417
9 votes
2 answers
42k views

How to check if firewalld is blocking an incoming ip address?

I have CentOS 7 with firewalld. I installed fail2ban and using the firewallcmd-new action. I am seeing bans in the fail2ban logs, and I want to check in firewallcmd if they are blocked. How can I do ...
giorgio79's user avatar
  • 1,877
9 votes
3 answers
7k views

fail2ban blocks IP in ignoreip list

I'm using fail2ban and it continues to block an IP even after I have whitelisted that IP. In /etc/fail2ban/jail.conf there is a line like the following one: ignoreip = 53.45.114.103 However fail2ban ...
bearrito's user avatar
  • 380
9 votes
1 answer
9k views

Why is fail2ban finding but not banning

I noticed something strange on my Ubuntu Xenial server. It has SSH on the default port and it has fail2ban. Fail2ban is detecting brute force attempts on the server and are logged accordingly: 2017-...
Waleed Hamra's user avatar
8 votes
2 answers
20k views

Get Fail2Ban To Check findtime Every X Minutes

I have fail2ban set up with the following settings: bantime = 86400 findtime = 600 maxretry = 2 This is great as it stops any IPs who are brute forcing 3 times within 10 minutes. However, there ...
DomainsFeatured's user avatar
8 votes
5 answers
21k views

ERROR Found no accessible config files for 'fail2ban' under /etc/fail2ban

So my fail2ban wasn't working and in attempts to make it work the config files got messy. Decided to start from scratch. I ran these as sudo apt-get remove fail2ban apt-get purge fail2ban rm -r /...
jblz's user avatar
  • 215
7 votes
1 answer
29k views

Using fail2ban to manually block an ip for a specific time period

I'm noticing that brute force password crackers are becoming more sophisticated, learning the rate at which their IPs get banned, and slowing their intrusion attempts so as to not be caught by ...
Trent Three's user avatar
7 votes
4 answers
10k views

Permanently and persistently ban an IP with fail2ban

I have set up a custom jail for a spambot that is giving me trouble. Using "bantime -1" I was trying to permanently ban the botnet. I thought it was working, but when the weekly logrotate occured ...
Tie-fighter's user avatar
7 votes
1 answer
19k views

How do I format this regex so it will work in fail2ban?

I've just installed fail2ban on my CentOS server in response to an SSH brute force attempt. The default regular expressions in fail2ban's sshd.conf file do not match any entries in audit.log, which ...
chapkom's user avatar
  • 181
7 votes
1 answer
9k views

fail2ban- How to whitelist a big list of IP address to the jail.local file

My CDN provider gives me a big list of IP to whitelist, I need to add them to the line of ignoreip = in jail.local. The list of IP address provided is line by line with one line one IP address, but ...
user394823's user avatar
7 votes
1 answer
36k views

Fail2ban doesn't start [closed]

I've done some changes to the file /etc/fail2ban/jail.local (a copy of /etc/fail2ban/jail.conf) and saved, but now fail2ban doesn't start. If I erase jail.local, then it start again. So the problem is ...
user268141's user avatar
7 votes
5 answers
10k views

Do AWS Servers need fail2ban?

I saw that while I was creating my AWS instance I opted for only my IP address being able to access my server. Also There is a RSA key that is configured for you. In this case do I really need ...
user avatar
7 votes
1 answer
3k views

How to properly configure fail2ban to ban IP if it is accessing some wrong files

I am trying to configure fail2ban on my test server. I want just to temporary block any script bots that try to probe my site. So everything that has cgi-bin, admin, setup.php and so on. I previously ...
Salvador Dali's user avatar
7 votes
1 answer
3k views

measures to take against a dns amplification attack

I recently discovered that my server was being used as part of a DNS DDOS. Basically, my BIND setup allowed recursion, and it was used to attack a certain IP address using IP spoofing. I took the ...
Waleed Hamra's user avatar
6 votes
4 answers
15k views

fail2ban not working on fresh install of ubuntu 14.04, why?

After installing and configuring fail2ban, I tried to login to my server through ssh with a wrong password. After a few attempts, I tried with the correct password with success. So, fail2ban didn't ...
punkbit's user avatar
  • 221
6 votes
1 answer
9k views

Fail2Ban: what is apache-overflows?

I am trying to configure fail2ban for my server and have come across: apache-overflows in the .config What does it do/protect against?
John Magnolia's user avatar
6 votes
1 answer
22k views

fail2ban for windows 2008 RDP [duplicate]

I'm looking for a solution to make remote desktop more secure. I'm looking for a fail2ban like for windows and specially for RDP which will block IP in firewall after N failed retries Any help?
IRIS's user avatar
  • 83
6 votes
6 answers
5k views

fail2ban and denyhosts constantly ban me on Ubuntu

I just got an Ubuntu instance on Linode. To secure the SSH on it, I installed fail2ban (using apt-get), but then had a problem: fail2ban kept banning my IP (for limited durations, thankfully) even ...
Trey Parkman's user avatar
6 votes
2 answers
3k views

Should i use Firewalld or Iptables for Fail2ban in Centos 7?

I'm setting up Fail2ban to protect ssh, and I use firewalld, I saw a lot of people recommending to use anaction = iptables-multiport and other solutions using iptables instead of firewalld claiming ...
Samuel E.'s user avatar
  • 177

1
2 3 4 5
15