Questions tagged [fail2ban]

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

Filter by
Sorted by
Tagged with
0
votes
1answer
48 views

Restrict fail2ban Filter to range of IPs

Is there a way to restrict a fail2ban rule to only set of IP ranges? This would basically be the opposite of the ignoreip config. We're experiencing intermittent (~2 hours a day, usually in the ...
0
votes
0answers
17 views

Blocking requests via Cloudflare at the firewall (not web server) level

The broad context here is that I wish for the firewall (pf) to be able to ban certain IP's from accessing the website. I first restore the origin IP in the web-server (Nginx) logs. Then I use ...
0
votes
2answers
98 views

Enabling other jails in fail2ban other than SSH

Installed Fail2ban on my Mail Server. As instructed, I copied the jail.conf into jail.local Here's what I have in my jail.local. I also copied logs from the log file of fail2ban. To me, it seems ...
1
vote
0answers
8 views

Fail2ban with Epoch time stamp

I do have a server running and in this log there are epoch time stamps is there a way to make rules /triger for fail2ban with those time stamps? A snippet for the log: 1588550278^connect 300: login: ...
0
votes
0answers
21 views

fail2ban finding, also listing but not banning

I am new to fail2ban, but I managed to set up a new filter my-botsearch (from https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/apache-badbots.conf) I adopted the regex a bit to match ...
0
votes
1answer
45 views

Using Fail2Ban as non root

What is the best way to add IP to Fail2Bans blocklist for normal user, (non root) but without giving full acces to fail2ban-client for that normal user. To run for example this command for normal ...
0
votes
1answer
26 views

Potential race conditions when using iptables-persistent and fail2ban together?

I'm using the iptables module geoip to only allow traffic from some countries and fail2ban in general to block scans. I'm aware of fail2ban itself managing the persistence of its rules. Now I also ...
0
votes
2answers
609 views

Blocking all malicious nginx connections with fail2ban

Recently there was a big increase in attacks on my server which made me switch to a more aggressive fail2ban blocking policy. In attempt to reduce the number of incoming connections I also ...
0
votes
0answers
32 views

How to properly make an ssh bastion, with fail2ban, in a Docker container

I've already asked the question on the Docker forums but so far no luck with a reply. I'm hoping I will have better fortune here. I’m in the process of making an ssh bastion (with fail2ban for ...
1
vote
1answer
49 views

How to block all ports for specific public ips using fail2ban with iptables [closed]

Kindly share the steps how to block all ports with specific public ips using fail2ban with iptables. I want to block all ports for the given ips by me and share the file name too. where i need to ...
0
votes
1answer
95 views

fail2ban jail.local/jail.conf does not have [ssh] section

I am new to fail2ban and am trying to harden a ssh server which is set up on a raspberry pi running raspbian buster. I understood that changes should be made to jail.local and I did that by copying ...
0
votes
0answers
23 views

Fail2ban-regex matches from string but not from filter.d files

I'm trying to match wordpress failed logins and I'm struggling with fail2ban configuration. The lines I'm trying to match look like this: 116.147.121.40 - - [26/Mar/2020:10:18:24 +0100] "POST /wp-...
0
votes
1answer
38 views

SSH Brute Force Login Attempts - enable automated email to abuse-mailbox

Running some servers I noticed increased SSH Brute Force Login Attempts over the years. fail2ban is a great tool which massively slows them down and can email the abuse-mailbox/OrgAbuseEmail of the ...
1
vote
1answer
55 views

getting flooded with HEAD requests

Our server got flooded with HEAD requests. This resulted in a spike in tcp connections that made the server unable to connect to its mysql databases. We make extensive use of the nginx ratelimiting, ...
0
votes
1answer
52 views

fail2ban fails to send banned IPs to Cloudflare

I am running a WordPress site on a CentOS 7 server. I have fail2ban installed and working, and have verified that it is adding IPs to iptables. I just added Cloudflare to the site, and now I'm trying ...
0
votes
0answers
103 views

fail2ban on centos 8 using iptables instead of firewalld

I have a question about fail2ban behavior and hope you could help to clarify. thanks in advance. So I had fail2ban running on a CentOS 8 server successfully but it just occurred to me recently ...
0
votes
0answers
15 views

fail2ban : reseting the iptables entries, although the release time has not yet come

I have a fail2ban service running on my server. After I was able to make it work fast by reducing the log files that it is reading, now I stumbled into another problem. Each time I restart the server (...
0
votes
2answers
1k views

What are missed lines in fail2ban?

I had millions of lines such as these in my log file yesterday: Feb 25 18:00:00 mond2 sshd[29574]: Bad protocol version identification '\003' from 54.37.78.250 port 50306 Feb 25 18:00:00 mond2 sshd[...
0
votes
1answer
193 views

fail2ban on Raspbian does not create iptables jails

I installed fail2ban 0.10.2-2.1 on Raspbian Buster to protect ssh (and if that works, apache). The default installation only enables de sshd jail, but in my case that does not seem to work. The ...
1
vote
2answers
86 views

Fail2Ban not banning, Regex shows many fails in logs

I have the following jail defined in my /etc/fail2ban/jail.conf. For privacy/security I've replaced references to IPs with local 10.0.0.x addresses. [ssh-iptables] enabled = true filter = sshd ...
0
votes
1answer
44 views

Fail2Ban does not send emails

Dear friends, Once again, I would like to enlist the help of this group! My fail2ban does not send emails in any way. I would like blocking notifications to be sent via email, but I can't seem to ...
0
votes
0answers
14 views

Blocking Logins in Drupal 7 does not work

​Dear Colleagues, Good afternoon! But once, I come to enlist the help of this group. Some will certainly remember me, with the PhpMyAdmin problem that I ended up solving with the update. Now, I ...
0
votes
1answer
77 views

Difficulties with Fail2Ban on PhpMyAdmin on CentOS

I am Brazilian and I still try to adapt with the English language. I'm having a hard time getting Fail2Ban to work on phpmyadmin. I'm using CentOS 8.1.1911 and fail2ban 0.10.5-2. My PhpMyAdmin is ...
0
votes
0answers
281 views

Fail2Ban -> UFW -> IPTables (how to log blocks)

Running: Ubuntu 18.04.4 LTS Fail2Ban v0.10.2 ufw 0.36 iptables v1.6.1 I've successfully setup fail2ban to use ufw to block ip's based on ssh authentication failures. As we know, ufw is just a front-...
0
votes
3answers
39 views

How to find cause of server hanging while having only 3 seconds of access

Remote debian buster server, so can't go to console. Yesterday it worked properly, today it has stopped responding. I can reboot it remotely, so after reboot I can reconnect, but I can only run short ...
0
votes
1answer
133 views

Fail2Ban not working with Feb 9 11:57:51 NOQUEUE: reject: RCPT from unknown[185.143.223.170]

I have these files in my mail.log file: Feb 9 11:57:50 ctrl-01 postfix/smtpd[21155]: NOQUEUE: reject: RCPT from unknown[185.143.223.170]: 454 4.7.1 <ian@restaurantlesbeatilles.com>: Relay ...
0
votes
0answers
70 views

Setting Up Fail2Ban

I am new to fail2ban. I want to setup Fail2Ban such that it bans an IP for one hour on two failed login attempts. I have the following setup: /etc/fail2ban/jail.local.conf [DEFAULT] bantime = 3600 ...
3
votes
1answer
699 views

fail2ban's database is too large (over 500mb). How do I get it to a reasonable size?

Recently my backups have started failing, and I tracked the problem to the file /var/lib/fail2ban/fail2ban.sqlite3. It is over 500mb. I am not sure whether it has been growing over time or if this is ...
1
vote
1answer
86 views

How to configure Fail2ban with private key ssh connection on CentOs 7

I tried to install Fail2ban on my Centos 7 machine to prevent force brute connection on ssh server. I'm using a private key with a passphrase to connect. I tested Fail2ban but it doesn't block me ...
0
votes
2answers
115 views

fail2ban action to route to another ip

I want to create a fail2ban action which routes the traffic to another IP on ban action, and removes the route on unban action. File: iptables-route.conf in /etc/fail2ban/action.d/ # Fail2Ban ...
0
votes
1answer
232 views

fail2ban error with firewalld (f2b-<jail name>: no such file or directory)

I have been using fail2ban for months without any issues but after a CentOS upgrade it stopped working. It seems it doesn't create the iptables entries. I have already tried restarting fail2ban, ...
0
votes
1answer
101 views

apache 2.4 with basic authentication and fail2ban apache-auth

It seems I have a conflict in my configuration on CentOS 7 server. The issue appears between vhost configuration on apache 2.4 (httpd) with the basic authentication and fail2ban apache-auth banning ...
0
votes
0answers
33 views

Allowing fail2ban to read logs on a NFS on a SELinux enabled CentOS 7 server

The title says it all, I need fail2ban to monitor logs on my NFS but it's getting blocked by SELinux. Here is an example from selinux logs: time->Thu Jan 9 03:56:45 2020 type=PROCTITLE msg=audit(...
0
votes
1answer
130 views

disbale fail2ban email notifications on a service?

Is there a way to continue to have Fail2Ban send email notification but disable it for an individual service? I keep getting 100 alerts on sshd and I would like to disable email notifications for sshd ...
0
votes
3answers
185 views

UFW + fail2ban not working with `nginx` to block attack scripts

my server is currently attacked by some script kiddies. I have set up fail2ban which correctly bans the IP. 2020-01-07 05:51:45,639 fail2ban.actions [1656]: WARNING [nginx-botsearch] 123.207....
0
votes
1answer
44 views

Unban everyone from a specific jail

I'm testing a jail configuration, and sometimes I need to release falsely banned IPs from that jail. So not a specific IP, not everyone from all jails, but everyone from a given jail. Closest I ...
0
votes
1answer
62 views

Fail2ban - apache-noscript.conf Filter not working

Every night bots try to penetrate my Apache Server: /var/log/apache2/error.log Output: [Mon Dec 30 02:55:39.098671 2019] [php7:error] [pid 14930] [client xxx.xxx.xxx.xxx:62420] script '/var/www/...
2
votes
1answer
1k views

Fail2ban on Debian Buster - the right way to configure?

Fail2ban can be configured in so many places. $ fail2ban-client -i Fail2Ban v0.10.2 reads log file that contains password failure report and bans the corresponding IP addresses using firewall rules. ...
0
votes
1answer
130 views

How to do IP address rate limiting in docker?

I have a docker webapp running, port mapped to a machine-running nginx server, and fail2ban to do rate limiting. Unfortunately, when viewing netstat, docker looks like its using all internal IPs (...
0
votes
1answer
51 views

Backup my custom iptables rules except fail2ban rules

What I have I have a few custom iptables rules blocking ports for everyone except my trusted IP addresses. Here's how I backed them up before: iptables-save > /etc/iptables.conf cat > /etc/...
0
votes
1answer
94 views

Why my Fail2ban regex doesn't find matches?

I have tried many regular expressions in fail2ban config, but it never return any matches. Line example: [2019-12-10 10:45:38] NOTICE[15077] res_pjsip/pjsip_distributor.c: Request 'INVITE' from '<...
0
votes
1answer
169 views

Strange constant message im mail.log: lost connection after AUTH from unknown

Anyone can help me understanding this message that keeps appearing in my mail.log: Dec 6 19:53:53 localhost postfix/smtpd[4873]: connect from unknown[185.234.219.94] Dec 6 19:53:53 localhost ...
0
votes
3answers
99 views

Reduce Load on Server when Bots Request non-existant Pages

Goal: Reduce Server Load from Malicious Requests Sometimes servers receive a large number of requests for pages that dont exist. Usually the requests are malicious in nature because the attacker is ...
0
votes
1answer
101 views

Fail2Ban Regex Does Not Match

I am unable to get my fail2ban fail regex to get to match to the log entries. The following is a sample log entry: Failed login attempt {"xForwardedFor":"192.168.0.38","remoteAddress":"::ffff:127.0....
0
votes
1answer
213 views

How to restrict fail2ban log file size?

Sometimes, fail2ban create huge log file in my Centos 7 server. 2.9G fail2ban.log 2.7G fail2ban.log-20191102 17G fail2ban.log-20191109 Then,I have questions as below: 1.If I delete ...
0
votes
1answer
240 views

unban or unblock IP-address from fail2ban and iptables

Fail2ban blocked an IP-address which I would like to undo. I have When I run sudo fail2ban-client set sshd unbanip xxx.xxx.xxx.xxx (where the xx-part is the IP-address) I get a response: NOK: ('...
1
vote
0answers
52 views

ssh, fail2ban and max login attempts

I am testing fail2ban in a Ubuntu 18.04 LTS server in VirtualBox. I set maxretry = 3 in /etc/fail2ban/jail.local, and I tried to ssh connect from another virtual machine with a wrong password. After ...
0
votes
0answers
111 views

The jail sshd has been stopped

I just installed fail2ban, copied /etc/fail2ban/jail.conf to /etc/fail2ban/jail.local and edited the following entries in jail.local: maxretry = 3 destemail = myemail@gmail.com sendername = fail2ban ...
1
vote
0answers
75 views

Fail2ban teamspeak failregex isue

can anybody help me solv this problem with failregex in my teamspeak.conf teamspeak.conf [INCLUDES] before = common.conf [Definition] failregex = ^(.*)query from .* <HOST>:.* attempted to ...
0
votes
0answers
45 views

Iptables not blocking subnet?

Fail2ban on my email server just banned the following offensive address: REJECT all -- * * 185.211.245.198 0.0.0.0/0 reject-with icmp-port-unreachable However I ...

1
2 3 4 5
11