22
votes
Accepted
Securing linux servers: iptables vs fail2ban
should I use fail2ban or iptables?
You use fail2ban in addition to a firewall solution, to extend on-demand those existing firewall rules with rules to block the specific ip-addresses of systems ...
- 80.3k
20
votes
Accepted
Blocking IPs in HAProxy
Thanks to a comment by EEAA, I was able to solve this using fail2ban.
There's very little documentation about how to use fail2ban with HAProxy, however - so little in fact that this page is already ...
- 391
16
votes
Get Fail2Ban To Check findtime Every X Minutes
As mentioned by Michael Hampton in a couple of comments, the reaction time, how often fail2ban checks the logs, has nothing to do with the findtime parameter. fail2ban is expected to read new log data ...
- 2,276
15
votes
How to secure servers from a cgi-bin/php POST request attack
Many years ago people used to run PHP as a CGI script (not even FastCGI, it didn't exist yet!) in part so that they could switch Apache from its low-performance prefork MPM to the new and somewhat ...
- 248k
8
votes
Securing linux servers: iptables vs fail2ban
should I use fail2ban or iptables?
This is somewhat akin to asking "should I use a seatbelt or a car?".
First off, remember that fail2ban really is only a tool to automatically detect recurring ...
- 4,455
8
votes
Blocking IPs in HAProxy
I'm glad that you seem to have solved the immediate problem with fail2ban, and it does make sense to block at the iptables level, but you can do the exact same thing in your HAProxy config:
You can ...
- 857
6
votes
How to find source of 4625 Event ID in windows server 2012
Working solution i found here: https://github.com/DigitalRuby/IPBan
For Windows Server 2008 or equivalent, you should disable NTLM logins and only allow NTLM2 logins. On Windows Server 2008, there is ...
- 161
5
votes
Accepted
Someone try to hack my server
First of all, don't panic. Check if any actual login has taken place.
If it has, panic.
If not, everything is still normal. There are many many machines out there trying to use common user/password ...
- 3,848
5
votes
How to secure servers from a cgi-bin/php POST request attack
The general problem is command injection. Made easier by old insecure CGI configurations allowing php execution direction, although a modern web server that sent a 404 isn't vulnerable to this ...
- 33.3k
4
votes
Securing linux servers: iptables vs fail2ban
I solved the same question some years ago. I decided to use iptables with recent modul because of performance and easy setup. I had to protect a lot of virtual containers on hosts.
Only keep in mind ...
- 314
4
votes
How to secure servers from a cgi-bin/php POST request attack
Mallicious attackers, or pentesters who want to get a part of your bug bounty will test your website for common errors made when writing web applications or configuring web servers. These attacks ...
- 906
4
votes
Accepted
Blocking "pokes" of our system
Block these from getting logged?
This does not seem a good idea : getting rid of logs will never improve security :)
Block the IP addresses that do this? Build a list of them to block?
That's ...
- 1,272
4
votes
Block bruteforce attempts with nginx & cloudflare without rate limiting
There are a few things you could do, you could farm out the task to Cloudflare before it even hits your network by developing a Cloudflare Worker monitoring for abuse: https://workers.cloudflare.com/
...
- 7,839
3
votes
Accepted
Fail2ban regex doesn't match my log
Try
failregex = \[client <HOST>:\d+\] .* WP login failed
You can use the fail2ban-regex utility to test regexes against example input files. That's a lot quicker and easier than trying to do ...
- 4,547
3
votes
fail2ban reject brute force spam bots
My suggestion for you is to use postscreen, more information here: http://www.postfix.org/POSTSCREEN_README.html
"The Postfix postscreen(8) server provides additional protection
against mail ...
- 1,914
3
votes
How to find source of 4625 Event ID in windows server 2012
I had the same type of events on a server. There were hundreds of login attempts with different user names but no process ID or IP address visible.
I'm pretty sure it was coming from RDP connections ...
- 31
3
votes
How to stop/prevent SSH bruteforce
I've just put this together, run every 15 mins as a cronjob etc:
for z in `grep Invalid /var/log/auth.log | awk '{ print $NF }' | sort | uniq`
do
count1=`grep $z /etc/hosts.deny | wc -l`
count2=`...
- 31
3
votes
Auto-ban IP from "wp-login.php" attackers
I finally just found a solution (I'll see if it works in a few days): fail2ban.
Let's put this in /etc/fail2ban/jail.conf:
#
# HTTP servers
#
[apache-wp-login]
enabled = true
port = http,https
...
- 739
3
votes
Accepted
SSHD: Difference between "connection closed..." and "disconnected from..." in log file
The messages:
Disconnected from invalid user
Connection closed by invalid user
both indicate a failed login attempt with a username that doesn't exist on your server.
The difference is just an ...
- 4,179
2
votes
Rate limiting with UFW: setting limits
It is worthwhile to point out possible unintended consequences of using ufw's LIMIT feature.
Suppose one placed a blanket limit on port 22/tcp as the first ufw rule:
To ...
- 727
2
votes
Ban IP address based on X number of unsuccessful login attempts?
This is an old thread. I was using the script provided by kevinmicke in 2014-2015. Then it just stopped working. So I had to edit it a bit to adopt to Windows Network Security authentication that does ...
- 21
2
votes
Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?
Denyhosts version 3.0: Every time an IP address appears in a log file, Denyhosts opens the hosts.deny file and reads the whole thing to match the address. Every time. Nothing is cached in memory. If ...
- 152
2
votes
Ubuntu Nginx after blocking ip address, still showing up in logs
Place a rule on top of everything using the insert option.
Step 1- Get the rule number:
sudo ufw status numbered
Step 2- Place this rule at the desired number - in this case 1, so that it ...
2
votes
Preventing brute-force attacks on MySQL?
1: Change the port from 3306. Not for reason of better security, but to take the load of the server to deal with false login attacks
2: Create SSL certificate and enable it on your MySQL server (it's ...
- 383
2
votes
Brute force ssh login attacks has slowed down my servers
You have not demonstrated that an attack on sshd is causing the problem. If you have correctly blocked port 22 then this should not be happening.
However, if (as it appears) you do not need to ...
- 116k
2
votes
Accepted
fail2ban reject brute force spam bots
There is always a balance to find with this sort of thing. A one off or infrequent failure is probably a mistake on the senders part. Multiple failures in a short time are likely an indication that ...
- 116k
2
votes
Accepted
Someone posting to /wp-login.php every 2 minutes. Is it commonly happens?
As those in the comments have stated, it is common. Likely those ips originate from the Western countries. Most of these insophisticated brute force attacks can be credited to bots or a botnet simply ...
- 136
2
votes
Brute Forcing IPs
You'll probably want to install LogRotate to help you keep the logs a bit tidier.
Fail2Ban could work for what you're trying to do but you may need to create some detailed filters in order to get ...
- 506
2
votes
Stopping SSH brute force from China - fail2ban not working
When looking into /etc/fail2ban/filter.d/sshd.conf there'll hopefully be according regular expressions for the Unable to negotiate with log entries.
sshd runs in normal mode, in order to detect ddos (...
- 121
2
votes
Postfix blank sender from= <>
The <> sender is the correct way to indicate that if a message cannot be delivered, no error report should be generated.
Error reports are generated with an empty sender precisely so error ...
- 3,357
Only top scored, non community-wiki answers of a minimum length are eligible