2022 Developer Survey is open! Take survey.

Questions tagged [fail2ban]

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

Filter by
Sorted by
Tagged with
0 votes
1 answer
14 views

Editing fail2ban apache-noscript config to add "AH10244: invalid URI path"

I have the following (default) /etc/fail2ban/filter.d/apache-noscript.conf configuration file: [Definition] script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl|\bcgi-bin/) prefregex = ^%(...
user avatar
  • 73
0 votes
1 answer
18 views

fail2ban iptables returned 200, iptables 0 references

I installed fail2ban but on start I got multiple error messages: iptables -n -L gives me 0 references for each jail. (should be 1?) Chain INPUT (policy ACCEPT) target prot opt source ...
user avatar
0 votes
1 answer
29 views

fail2ban appears to be working but server still receives connection attempts

fail2ban mistery! Everything seems to be working and well configured but server still receives connection attempts. [moso@matrix ~]$ sudo systemctl status fail2ban ● fail2ban.service - Fail2Ban ...
user avatar
  • 1
0 votes
1 answer
31 views

fail2ban not banning but matches logs

I try to create a brute force protection with fail2ban. With the fail2ban test, it matches the logs I wanna match but with my test brute forcing the site with 7+ failed logins, it does not ban my ip ...
user avatar
0 votes
1 answer
16 views

sendmail and pacemaker require different /etc/hosts

Trying to make run sendmail (required by fail2ban, or it takes forever to start-stop-restart it) and pacemaker on one machine. Sendmail wants machine's hostname resolved as 127.0.0.1, pacemaker - as ...
user avatar
0 votes
2 answers
58 views

fail2ban not banning "matched" IPs from vsftp log

Using fail2ban to secure the vsftp login: jail.local [vsftpd] enabled = true bantime = 600 findtime = 5000 maxretry = 1 port = ftp,ftp-data action = iptables-multiport logpath = /var/log/vsftpd/...
user avatar
0 votes
1 answer
69 views

Is it necessary to ban malicious IP regardless of default firewall setting being deny/reject?

I'm on Linux and using fail2ban as the ban system. So far, it has collected and banned about 150K of malicious IPs, and I'm concerned and wondering if this will gobble a fair amount of resources. As I ...
user avatar
  • 1
0 votes
2 answers
161 views

can fail2ban add deny rules to nginx instead of using iptables

I'm having one server, that is behind a reverse proxy, that I don't control. I'd like to use fail2ban to block nginx traffic under certain conditions. normally fail2ban useses iptables to block ...
user avatar
  • 203
0 votes
2 answers
101 views

block nginx connection after multiple 404 s on same tcp connection

I'd like to protect two servers against attackers who blindly probe for urls. my idea is to block requests after a certain amount of 404 status codes. I could do this with fail2ban. However one of the ...
user avatar
  • 203
0 votes
1 answer
157 views

fail2ban: apache-badbots is not working

I have a working fail2ban configuration which not only blocks IPs but also announces them to the AbuseIPDB. This is working fine for sshd and postfix-sasl, but not for apache-badbots (and resultign ...
user avatar
  • 101
0 votes
1 answer
317 views

Fail2ban bantime.increment not working

I wanted to increase the bantime of repeat offenders getting caught by fail2ban. I added the following lines at the top of /etc/fail2ban/jail.local and fail2ban.local [DEFAULTS] bantime.increment = ...
user avatar
  • 251
0 votes
1 answer
56 views

Backtesting Historical Logs in fail2ban

Setup I'm running apache on an ubuntu server. I've created a fail2ban rule which bans an ip when they request too many pages too fast. # Fail2ban Rule failregex = ^.*?(:80|:443) <HOST> - .* &...
user avatar
0 votes
1 answer
35 views

Bot detection by fail2ban

I want to know if it is possible to use in fail2ban some rule / script that detects the bots, not just by maxretry in a given amount in seconds, but through identifying some patterns for every IP: for ...
user avatar
  • 1
0 votes
1 answer
156 views

fail2ban fails to add iptables to rules

I'm having issues with fail2ban is not adding the banned IP to iptables. this is the error; 2022-01-29 15:13:48,499 fail2ban.actions [2608]: NOTICE [man] Restore Ban 212.192.246.26 2022-01-29 ...
user avatar
0 votes
1 answer
96 views

How to create failregex to block imap-logins fail2ban

Could someone help me with creating correct fail2ban filter. Bad ip addresses knocking port 993 /etc/fail2ban/filter.d/dovecot.conf doesn't catch such log I found something like this, but i get errors ...
user avatar
  • 1
0 votes
0 answers
39 views

How to log fail2ban packets in nftables

I use fail2ban with an ssh jail. In my nftables directory I have a configuration file #!/usr/sbin/nft -f table ip fail2ban { chain input { type filter hook input priority 100; log ...
user avatar
-2 votes
1 answer
86 views

FAIL2BAN filters- who can give me filter to block this intrusion?

I see in my mediatemple server maillog endless intrusion. i need to block these ips. who can help with filter file to match these? Jan 21 07:51:44 mydomain postfix/smtpd[23505]: SSL_accept error from ...
user avatar
  • 1
0 votes
2 answers
220 views

FAIL2BAN filters. Any filter for this intrusion by internet search scanners?

Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: connection established Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: master_notify: status 0 Jan 19 22:49:00 intelligent-...
user avatar
  • 1
0 votes
1 answer
130 views

Use value of <F-USER> from fail2ban regex

I am trying to send e-mail to me and user that someone tried to login to their ssh and failed - the IP got banned. But I don't understand how can I use the variable in the e-mail I am trying to send. ...
user avatar
0 votes
1 answer
38 views

Failed to restart fail2ban.service: Unit firehol.service not found

When you come accorss this error after uninstalling Firehol. Check that you don't have this block: [Unit] # Starting fail2ban will automatically start firehol before it. # Stopping firehol will ...
user avatar
  • 123
1 vote
1 answer
33 views

Implement fail2ban to prevent brute force attack on a web site (using standard user authentication); work when the number of tries = maxretry+1

I am working on an course assignment to implement fail2ban to prevent brute force attack on a web site (using standard user authentication). I have set up my apache web server as well as fail2ban ...
user avatar
  • 11
1 vote
1 answer
102 views

Enabling PHPMYADMIN Logging & Fail2ban Default Filter

I am on Debian 10.5 LAMP with ISPConfig, running PHPMYADMIN 4.9.0.1. I installed phpmyadmin following this tutorial I can only guess that somehow ISPConfig may be interrupting something. In any case, ...
user avatar
0 votes
0 answers
115 views

Is it worth it to install and configure fail2ban for an Bind9 authoritative DNS server?

In our project infrastructure we have a nameserver, based on bind9. This nameserver is configured as primary and authoritative, so it is quite important. The question is, should I install and ...
user avatar
  • 21
0 votes
1 answer
245 views

fail2ban - Additional regex for sshd filter

I am currently trying to catch failed SSH login attempts with certificate based authentication (certificate correct but wrong password) using fail2ban version 0.11.2-2 (running on Debian 11). ...
user avatar
  • 1
0 votes
1 answer
290 views

HINT on 127: "Command not found" fail2ban

I have a problem with Fail2ban. In the log I have this: 2021-12-05 00:49:23,968 fail2ban.utils [979765]: ERROR 7f9a6df8cdf0 -- stderr: '/bin/sh: 1: iptables: not found' 2021-12-05 00:49:23,...
user avatar
0 votes
1 answer
43 views

Which protections can I use on the server

I have read about server protection and I know how to work with fewalld protection because it is not demanding. My question is: Which of the following protections is best for the server and which of ...
user avatar
  • 17
0 votes
0 answers
37 views

Fail2Ban not sending IP to iptables

Fail2Ban seems to be working fine Status for the jail: nginx-php |- Filter | |- Currently failed: 1 | |- Total failed: 22 | `- File list: /var/log/nginx/access.log `- Actions |- Currently ...
user avatar
1 vote
1 answer
222 views

Fail2ban filter for error 400 on nginx

I have a nginx server I am hosting very base php website (school club) and log file show lot of weird requests how do I block them. I tried using fail2ban but my filters were not accurate. nginx-400....
user avatar
  • 11
2 votes
1 answer
205 views

My custom fail2ban jail fails to load even though fail2ban-regex suggests that it should work?

I've written a custom jail and filter in fail2ban for logging into my service. The log file is located in /var/log/motion/motion.log and a failed login generates a line like this: [0:ml1] [ALR] [STR] [...
user avatar
1 vote
0 answers
314 views

Creating a custom filter for fail2ban

I'm trying to create a custom jail and filter in fail2ban for motion stream http authentication. The log directory is /var/log/motion/motion.log and a failed login attempt generates: [0:ml1] [ALR] [...
user avatar
2 votes
1 answer
306 views

Fail2ban ipset - which conf to use?

I have read that iptables can be slow in case of large number of ip addresses and ipset is more preferred in that scenario. I would like to use ipset banaction but there are at least 3 of them, ...
user avatar
  • 23
0 votes
1 answer
169 views

fail2ban does not work for ssh except on port 22

My fail2ban is not working for sshd except for the default port 22/tcp. My old, working config in jail.local: [sshd] enabled = true port = ssh Tested fail2ban, did ban me after 3 failed attempts ...
user avatar
  • 103
0 votes
1 answer
99 views

Can fail2ban-client tell me if an ip from a CIDR range is in a jail? [duplicate]

If I have a CIDR like 13.54.63.128/26 can fail2ban-client tell me if there's an IP in this range that's currently banned? Currently I'm doing: CIDR="13.54.63.128/26" nmap -sL -n $CIDR | awk '...
user avatar
  • 295
1 vote
0 answers
23 views

get mail from fail2ban only if aspecific ip(range) is blocked

is it possible to get only mails from fail2ban if a specific IP(range) is blocked? I got it configured that I got mails if an IP blocked, which works fine
user avatar
  • 121
0 votes
0 answers
256 views

cURL suddenly gives Connection Refused to an Ubuntu Server

I have a custom wordpress "client" plugin that makes a cURL call to a Node app on an Ubuntu server. The call works perfectly from every WP installation, except for one where everything ...
user avatar
2 votes
1 answer
98 views

Fail2ban partial IP match possible?

My server (Ubuntu 18.04) is getting a lot of spam requests on Postfix. Fail2ban is working but the spammers keep changing the last part of IP and not getting banned. For example, 2021-10-09 09:40:01,...
user avatar
  • 251
0 votes
1 answer
66 views

Fail2ban regex not working

I would like to block any get request to /.git, /wp-login,/remote/login/, so i have created the following filter which also includes other requests. badagents = 360Spider|ZmEu|Auto Spider 1.0|zgrab/...
user avatar
  • 101
0 votes
1 answer
151 views

fail2ban unban every ip when the server is shutting down, restoring every ban back again when newrly started

I have multiple jails with several thousands of banned IPs. The server was running for about a week non-stop, then when I was restarting it it took quite a long time ~2 mins to shutting down, and when ...
user avatar
0 votes
1 answer
107 views

Fail2ban Filter Regexp

im use centos8 +fail2ban + haproxy I have special jail "my-haproxy404" with this settings: [my-haproxy404] enabled = true port = http,https filter = my-haproxy404 logpath = /var/log/...
user avatar
1 vote
1 answer
131 views

Fail2ban socket permissions reset on reboot

I have some specific group/permissions set for my fail2ban.sock file to make Zabbix able to monitor Fail2ban as described here https://github.com/hermanekt/zabbix-fail2ban-discovery- I added the ...
user avatar
  • 33
2 votes
1 answer
360 views

fail2ban detects the attacker IP but doesn't ban it, and is slow reading logs

From a few days I'm receiving attacks from some IP addresses to my nginx. I have decided to use fail2ban to ban it automatically, but I have noticed that is not working very well. I can see in logs ...
user avatar
0 votes
1 answer
72 views

Why my port 27015 is scanned by several ISP across the world?

I configured my server to block all ports except 22,80 and 443 with UFW. I then created a fail2ban rule to put in jail every IP that scan ports unsuccessfully more than 5 times and report it to ...
user avatar
0 votes
1 answer
125 views

Fail2ban not blocking ssh attempts

I have set up fail2ban to block failed ssh attempts. I checked the rule with fail2ban-regex and and an extract from my logs, this works fine. I also checked the logs for the "Ban" notice and ...
user avatar
0 votes
1 answer
263 views

Fail2Ban blocks ip despite both ignoreself and ignoreip being set in jail.local

solution: The IP range in ignoreip was set incorrectly using CIDR. It should have been 192.168.2.0/24 rather than 192.168.2.1/32. original post: Another user had a similar problem caused by ...
user avatar
  • 1
0 votes
1 answer
79 views

Fail2Ban banning addresses that SHOULD already be banned

I am running the default fail2ban ssh-auth rule to ban ips with 3 or more failed auth attempts in a window. However, I noticed a particular network being the source of a disproportionate amount of ...
user avatar
1 vote
1 answer
108 views

Fail2ban filter for mongodb

Fail2Ban version: 0.10.2 I have tried a lot of filter config files for MongoDB remote authentication fail, none of them have been working, I have figured that the problem is with failregex and I am ...
user avatar
0 votes
1 answer
306 views

iptables block everything but http/https/ssh

I have this iptables configuration on my vps which is supposed to run Wordpress. What I want to do is block every incoming request except http on port 80, https on port 443 and ssh on port 22. Chain ...
user avatar
2 votes
2 answers
1k views

fail2ban does not use DROP blocktype

Using Ubuntu 20.04 LTS, I have this in /etc/fail2ban/jail.local: [DEFAULT] bantime = 3600 banaction = iptables blocktype = drop [sshd] enabled = true protocol = tcp port = ssh filter = ...
user avatar
  • 657
0 votes
1 answer
141 views

How do I set up Fail2Ban on an Amazon Lightsail Debian instance, when it has its own firewall?

This is a very basic question, but all the answers I can find either relate to WordPress installs or Bitnami installs. I have a plain Debian instance running Nginx. I would like to set up Fail2Ban. ...
user avatar
  • 145
0 votes
1 answer
317 views

Create own filter for fail2ban fails

I'm playing around with fail2ban in kubernetes. For that I created a pod that creates fake log messages: 2021-08-04 18:33:13 Authentication failed 15.15.15.15 I created a custom filter, to test if ...
user avatar
  • 101

1
2 3 4 5
14