Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

Questions tagged [fail2ban]

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

0
votes
1answer
52 views

Fail2ban only works with log files? [closed]

What about Unix sockets? I have created my own server application that needs protection. My two options: Creating a log file for fail2ban to watch Establish networking between my server application ...
0
votes
0answers
9 views

Identify diffrent nginx 444 in logs to apply certain fail2ban rules

I have some rules in nginx to block trafic: bad bots/user agents, ips, wp-logins. All rules block with return 444 fail2ban is listing nginx logs, but can't diferenciate the rules all rules are 444. ...
0
votes
1answer
16 views

fail2ban filter parsing error

I'm trying to add an extra filter rule to the fail2ban exim filter. I want to catch bad bot attempts that try to send auth too soon. My exim.conf filter's failregex looks like this (with the last ...
0
votes
1answer
106 views

How to block IPs that cause excessive 404 errors with Fail2ban?

I have installed Fail2Ban v0.10.2 on Ubuntu 18.04 with Apache 2.4.29 and enabled the standard ssh and apache jails for basic protection with email notification warnings, when an IP is blocked. Having ...
0
votes
0answers
13 views

What does set logtarget Syslog 2 mean in logrotate.conf file?

I am using latest version of CentOS with NGINX. My Logrotate.conf file has two blocks/directives for fail2ban log (maybe it was a mistake by my previous hosting provider). Therefore, I am receiving ...
1
vote
1answer
52 views

How to create a regular expression for an openvpn fail2ban filter

Some people are trying to get into my openvpn server. For now I'm manually banning each IPs because I don't know how to setup a fail2ban regex. The content below is basically what is found in my /var/...
1
vote
0answers
48 views

fail2ban error: fail2ban-client: ERROR No file(s) found for glob

I installed a server inside docker: logs are mounted in a shared volume with host. In the host i m checking a log file with fail2ban. I can't understand why fail2ban gives this error fail2ban ...
0
votes
1answer
82 views

Using fail2ban to block mysql on localhost

I have fail2ban working on my server and it does ban SSH but I'm having problems banning users trying to access MariaDB using MySQL. I'm also using Adminer which is the main reason why I'm trying to ...
1
vote
1answer
26 views

fail2ban failregex apparently not banning

After noticing repeated attempts to access supposed webadmin resources on my server in blocks by the same ips (i.e. repeated attempts from each ip in a long list of 'common' server webadmin resources, ...
1
vote
0answers
39 views

Block public IPs routed through reverse proxy

I have setup my router to port forward traffic from a specific port to a server acting as a reverse proxy. The server is based on CentOS 7 with Apache 2.4.6. One of my backend servers is also CentOS ...
-1
votes
3answers
202 views

Fail2ban unban action fails with Cloudflare

I'm trying to setup Cloudflare blocking with fail2ban using this guide and while it bans the IP correctly, fail2ban cannot unban the IP from Cloudflare either after timeout or with manual shell ...
0
votes
0answers
110 views

fail2ban permanently ban IP based on directory access

First question here. I am getting tons of requests in my apache error log trying to find files in directories that does not exist. And I am thinking, this is annoying but also a honeypot opportunity....
0
votes
1answer
70 views

fail2ban does not start up on ubuntu 16

I installed fail2ban on ubuntu 16 on which I also have ufw. I copied jail.conf to jail.local in /etc/fail2ban. After this, I tried starting fail2ban but I get the following error in the logs (using ...
-2
votes
1answer
84 views

unable to jail ssh fail2ban 0.9.6

I am on Centos 6.9 with fail2ban 0.9.6. I have the below SSH jail but after restarting fail2ban it is not enabled when running fail2ban-client status. The conf I used is /etc/fail2ban/jail.local. I ...
-1
votes
3answers
129 views

nginx - Is this a bad bot? [closed]

I have these entries in /var/log/nginx/access.log: 107.155.152.109 - - [22/Mar/2018:19:20:54 +0000] "GET / HTTP/1.0" 301 193 "-" "-" 162.216.152.56 - - [22/Mar/2018:19:21:40 +0000] "GET / HTTP/1.0" ...
0
votes
0answers
170 views

sshd.conf fail2ban not banning cipher / key exchange

I have frequent attempts to use ssh cipher or key exchange to compromise our system. (from /var/log/auth.log) Mar 7 18:48:00 smb sshd[15022]: fatal: Unable to negotiate with 103.99.2.190 port 64720: ...
0
votes
1answer
56 views

Should I remove the ipv6 of my server from trusted IPs of fail2ban v0.9? [closed]

I have new Plesk Onyx server with CentOS 7. I installed the Fail2ban component (the version installed is v0.9.6). In the fail2ban.log I see a lot of warnings like this: WARNING Unable to find a ...
1
vote
1answer
82 views

fail2ban regex matching on testing sites, but not fail2ban itself

Hi so I'm trying to match the following log line: E/Sun, 04 Mar 2018 21:40:32 +0100: Error logging in from RemoteIP: 1.2.3.4 And after many hours I've finally got a regex that works on debuggerex, ...
1
vote
0answers
597 views

fail2ban does not seem to ban an IP after repeated failed ssh login attempts

I'm trying to figure out why Fail2Ban doesn't seem to be doing anything on my server. This is an Ubuntu 14.04 server: $ lsb_release -a No LSB modules are available. Distributor ID: Ubuntu ...
1
vote
1answer
269 views

Enabling fail2ban 0.10 on ipv6

I just upgraded to fail2ban version 0.10 on debian via apt-get. I see things like this in 'iptables -n -L': Chain f2b-apache-auth (1 references) ... Chain f2b-pam-generic (1 references) ... but I ...
0
votes
1answer
117 views

iptables rules dissappear when manually adding a nat rule to iptables-persistent file

I noticed that about two-thirds of the rules I have specified in /etc/iptables/rules.v4 stopped showing in sudo iptables -S after I added a nat rule. (I isolated the disappearance to adding this one ...
0
votes
1answer
85 views

Troubleshooting a problematic IPTABLE rule

Background I am very new to Fail2Ban, UFW, and IPTABLES. The rules in place on the VM in question, were mostly generated automatically. Some I added after following instructions for such. One is ...
-1
votes
1answer
108 views

fail2ban-regex <HOST> filter missed

quick question regarding fail2ban filter regex problem I have a log pattern: 2018-02-06 07:40:20,954 fail2ban.actions [26058]: NOTICE [postfix-sasl] Ban 192.168.2.14 I try to Ban IP (192.168.2.14) ...
0
votes
1answer
270 views

How can I get nginx-botsearch of Fail2Ban to match a string but also not match that same string if it has additional trailing characters?

System is Ubuntu 16.04. Using fail2ban from the package manager (which is currently 0.9.3-1). Have enabled nginx-botsearch in jail.local. Here is my /etc/fail2ban/filter.d/nginx-botsearch.local (note ...
0
votes
0answers
99 views

fail2ban inside lxc container, gets error message

I want to run fail2ban inside an unprivileged lxc-container (named testc2, debian stretch), but get the following error message root@testc2:/# service fail2ban start Job for fail2ban.service failed ...
0
votes
0answers
66 views

How can i use fail2ban when using mod_wsgi with django?

Fail2ban blocks access based on the contents of apache errorlog, a classic error log line will contain the ip address to ban, but when using django applications (apache and mod_wsgi) the errorlog ...
0
votes
1answer
240 views

fail2ban hanging on creating SSL Certificates all day

I tried installing fail2ban today on my ubuntu 16.04 server. It seemed to install correctly. Unfortunately, this command has been running now for over 3 hours. Creating/Updating SSL(for TLS) ...
0
votes
1answer
367 views

fail2ban cannot set iptables rules

I have only a thin knowledge of both iptables and fail2ban, but my mail server has a lot of incoming connections that I want to get rid of. I have this config block in /etc/fail2ban/jail.conf [...
0
votes
1answer
177 views

fail2ban - Filter IPs by cidr blocks

I'm using fail2ban 0.10.0 and with it I'm able to trigger some actions to block bruteforce attempts from a given single origin (with the HOST tag). But suppose someone has control over an entire /24 ...
0
votes
1answer
119 views

Understanding fail2ban mechanisms

Apache 2.4 Fail2ban 0.9.6 Jail.local [with_ip_only] Maxretry = 3 Findtime = 600 Bantime= 60000 Banaction = iptables-allports I have this guy [46.xxx] scanning my server and I’m wondering why ...
2
votes
1answer
146 views

Configuring an alternate jail in fail2ban for manual use

I have a fail2ban instance that works well. But I also like to occasionally examine the logs manually and try to ID system probes that are working around my standard f2b definitions. What I'm ...
0
votes
0answers
106 views

How to add CDN ip address on the whitelist of fail2ban?

Im using KEYCDN on my wordpress blog. I use also fail2ban with the jail /wp-login My problem is the CDN server tries many times to POST on my wordpress website on the login page /wp-login.php which ...
1
vote
0answers
45 views

Did someone succeeded in getting to my server? [duplicate]

I have a server running ubuntu 14.04. On it i have latest wordpress version on nginx. I was going trough my logs and noticed this. 198.204.224.122 - - [05/Dec/2017:13:06:10 +0200] "GET / HTTP/1.1" ...
0
votes
1answer
116 views

Overriding an entry in paths-common.conf with paths-common.local in fail2ban?

OS is CentOS 6.9, with fail2ban-0.9.6-1.el6.1.noarch According to the fail2ban manual: Every .conf file can be overridden with a file named .local. The .conf file is read first, then .local, with ...
0
votes
1answer
118 views

How to make fail2ban block access to webpage on specific port [closed]

I am trying to deny access to all IPs except my own IP address. I think I could do this using Nginx log file, and create a filter and rule in fail2ban. However, this specific page is on a port like ...
1
vote
1answer
130 views

Fail2ban jailed but IP still accessing server

I've got a server running a bunch of WordPress sites, and each of these sites refuse logins from IP's after a number of failed logins. The steps are as follows: 3 failed logins from an IP = WP ...
1
vote
1answer
48 views

fail2ban ssh login waiting time after failure

This is what I want to do: If you login with ssh and fail 3 times then you have to wait for 30sec to try again.. 4 times = 60sec 5 times = 300sec ... 10 times = banned I googled my wish and I ...
0
votes
0answers
124 views

Fail2ban is too strict. How to relax it a little

I'm running Ubuntu 16.04 where I've Fail2ban installed by default. Everytime I use it on a new network I get blocked after using it a little bit most probably because I access multiple subdomains ...
0
votes
0answers
275 views

How to configure Fail2ban for phpMyAdmin and phpPgAdmin?

I configured Fail2ban to ban all ip's trying to log to my server through ssh, and it works pretty well. Now I want to protect "http://example.com/phpmyadmin/" and http://example.com/phppgadmin/" from ...
0
votes
1answer
290 views

fail2ban not starting jails

I'm going nuts on my live server where fail2ban is not starting jails anymore. When i start fail2ban, everything looks fine: fail2ban-client -x start: 2017-11-14 15:51:32,403 fail2ban.server : INFO ...
0
votes
1answer
85 views

Fail2ban not listening on correct ports

Fail2ban was working but I went to pentest my server and for whatever reason, the Apache2 jails are not working. I checked IPTables with iptables -S and there are 9 entries for -A input -p tcp -m ...
2
votes
1answer
57 views

Jail errors & wont start

I've created a jail and action in an attempt to catch "DDoS attacks", however the log files show errors for this jail whenever I restart Fail2Ban. The jail & filter seem fairly straightforward, ...
0
votes
1answer
623 views

How can I have fail2ban log to an external syslog server?

I'm running an Ubuntu 16.04 web server (running Webmin). I also have Graylog running on a separate server on my LAN. I'd like to have fail2ban log itself to /var/log/fail2ban.log as well as my ...
4
votes
1answer
428 views

Maximum bantime with fail2ban

I am using fail2ban/firewalld to restrict bot-like access to a Nginx server. Typically, the configuration of the corresponding jail looks like: [nginx-botsearch] #banaction = iptables-multiport ...
0
votes
1answer
132 views

fail2ban create jail failed

I have debian jessie, with fail2ban v0.8.13 and virtualmin. I use iptables but firewallD was install and uinstall maybe it's the problem.... the problem is: the think for all Jail 2017-09-20 11:33:...
3
votes
0answers
617 views

Fail2ban with nftables and IPv6

EDIT: added additional .conf filer and slightly changed wording as suggested by Marco I'm running Fail2ban v0.10 which is supposed to support IPv6. I've set up Fail2ban with nftables according to ...
1
vote
1answer
88 views

Fail2ban sending notification of ban, but not actually banning

So, I tested Fail2ban on ssh today with an IP which should have never connected to the server before. First, the only thing I changed in the default config (apart from the mail-address) is this here: ...
0
votes
2answers
115 views

A smart attack on SMTP evading fail2ban

I have an ongoing brute-force attack on my SMTP server in a way that evades typical fail2ban settings: attacks take place from several IPs in the same subnet a single IP attacks in intervals longer ...
1
vote
1answer
73 views

Do fail2ban and apf+bfd complement each other?

Researching on the differences between Advanced Firewall Policy (APF) together with Brute Force Detection System (BFD) and Fail2Ban I couldn't find much. They use different methods, at the same time ...
2
votes
0answers
66 views

fail2ban appends to chain after installing iptables-persistent

I've used fail2ban a while now. Today I wanted to learn more about iptables and found iptables-persistent. After installing, saving and cleanup the iptables rules in /etc/iptables/rules.v4 it looks ...