Questions tagged [fail2ban]

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

Filter by
Sorted by
Tagged with
-1
votes
1answer
30 views

Fail2Ban is not updating iptables rules

I have set up fail2ban to protect my ssh port using these rather old instructions: https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-14-04 I tested my set-up ...
1
vote
2answers
23 views

fail2ban weird ban behaviour bans not IP properly

I'm try to ban all suspect 403 errors via fail2ban. So I created this jail # block 403 errors [apache-403] enabled = true filter = apache-403 port = http,https logpath = /var/log/apache2/...
1
vote
1answer
74 views

Fail2Ban with named and systemd on Debian 10

default in Debian 10 named is logging to systemd. Latest filter in fail2ban: https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/named-refused.conf is working only with /var/log/named/...
0
votes
1answer
63 views

I'm Under attacks even with mod_evasive mod_security and fail2ban [closed]

I have my centos fresh server with no problem, I have httpd, named but I get 150 failed logins per 10 minute. I also use Fail2Ban with maxretry 1 findtime 6h. and mod_evasive mod_security default ...
0
votes
2answers
50 views

Is fail2ban working without firewalld?

do i need firewalld for fail2ban to work? Can fail2ban block IP's with iptables only? I've installed iptables-service on a CentOS 8 vps. I use nftables v0.9.3 (Topsy) to restrict/grant access. ...
1
vote
1answer
89 views

Fail2ban banning odd IP address that are not in logs (0.0.0.4, 0.0.0.5, etc)

Server: Nginx Fail2ban version: v0.9.3 It seems like no matter what I try, I cannot get fail2ban to find the correct host from the log entry consistently. /etc/fail2ban/filter/expanse-bot.conf: [...
1
vote
1answer
39 views

Harassed by ssh connection attempts, how to make fail2ban more strict?

I use the default fail2ban configuration for ssh connection attempts on my Debian server hosting my web and mail servers. I already switched away from the default ssh port and things were quite for a ...
3
votes
1answer
313 views

fail2ban: whitelist IPv6 address

I need to whitelist an ipv6 address in fail2ban, however when I just add them to the ignoreip statement in my jail.conf they get blocked anyways. This is what I have in /etc/fail2ban/jail.conf [...
0
votes
1answer
37 views

Postfix/Fail2ban, Send mail to admin on problems

I would like for Postfix if possible, or Fail2ban if possible (without banning) to send a notification email to root or an admin account with the logline when something wrongs happens when sending an ...
0
votes
0answers
51 views

Fail2Ban: Are these IPs really blocked?

This is my jail.local [DEFAULT] ignoreip = 127.0.0.1/8 192.168.1.0/24 [nginx-custom] enabled = true logpath = /var/log/nginx/access.log action = iptables-multiport[name=nginx-custom, port="...
0
votes
1answer
23 views

Should I, and how should I defend against DOS SMTP attack

I was troubleshooting an outlook client trying to authenticate with the Mail server, and the client would time out ( it was an issue with a local outlook installation & machine firewall) To ...
1
vote
1answer
37 views

Fail2Ban: Why Fail2Ban is banning Cloudflare ips, but rules seem not match?

This is my /etc/fail2ban/filter.d/nginx-custom.conf [Definition] badagents = 360Spider|ZmEu|Auto Spider 1.0|zgrab/[0-9]*\.[0-9a-zA-Z]*|Wget\(.*\)|MauiBot.*|AspiegelBot.*|SemrushBot.*|PHP/.* ...
0
votes
1answer
148 views

fail2ban not working with SSHD using busybox-syslogd

I am running fail2ban (0.9.6-2) on Debian 9 with busybox-syslogd logging to /var/log/auth.log setup with the following line in /etc/rc.local to get logs written to file. /sbin/syslogd -O /var/log/...
1
vote
1answer
75 views

Fail2ban how to configure custom fail regex filter

I am running fail2ban on Debian 9 and am trying to create a custom filter to ban an ip after 4 failed attempts. Can someone help to figure out what I need to put in filter.d and jail.conf in order ...
1
vote
1answer
40 views

Fail2ban - stop DOS attack from remote host - won't start

SOLUTION ##To stop DOS attack from remote host. [http-get-dos] enabled = true port = http,https filter = http-get-dos logpath = /var/log/apache*/access.log maxretry = 400 findtime = 400 bantime ...
1
vote
2answers
344 views

Is it safe to apply fail2ban on sshd “Received disconnect/Disconnected … [preauth]” logs?

I'm seeing a lot of logs like these in /var/log/auth.log (Debian Buster): Jan 2 17:10:17 mybox sshd[16304]: Received disconnect from 1.2.3.4 port 37792:11: Bye Bye [preauth] Jan 2 17:10:17 mybox ...
0
votes
0answers
31 views

Fail2Ban failregex after office hours

How can we run specific failregex after office hours, and ignore during office hours as some of the conditions may detect wrongfully. e.g this could be from users: failregex = ^\.\d+ \[WARNING\] ...
6
votes
1answer
136 views

I can not seem to get a Regex for to Fail2Ban to work with Opensmtpd? Can I get a sanity check?

I have openSMPTD running a mail server. It seems I am getting brute forced attacked currently, although I doubt they will get in. That being said, I would like to alleviate the burden on my server ...
0
votes
2answers
150 views

fail2ban : get the jail for a baned IP

there are a lot of reasons why someone want to know the JAIL that banned a IP, but I do not find a fail2ban-client command to tell me this. there should be a get command that does on require , and ...
1
vote
1answer
90 views

IPTables causes conflict with Fail2Ban

OS: Ubuntu Server 18.04 Fail2ban: v0.10.2 I am trying to understand a bug with my Fail2ban installation (I believe from my own making). I have a cron job that populates iptables with a predefined list ...
0
votes
0answers
142 views

fail2ban fails to ban IP with “already banned”

I enabled the dovecot plugin on my server and after a while (read: 10 seconds), I got my first ban: 2020-12-20 08:05:22,349 fail2ban.actions [1495]: NOTICE [dovecot] Ban 212.70.149.85 2020-12-...
1
vote
1answer
115 views

Ubuntu 20.04, fail2ban bans IPs and puts them into iptables, BUT banned IPs can still connect and fail2ban log says IPs are already banned

Ubuntu 20.04. I have a huge amount of records in my /var/log/nginx/access.log that look like this: 85.249.25.218 - - [15/Dec/2020:08:12:15 +0300] "POST /api/v1/device/analytics HTTP/1.1" 404 ...
0
votes
1answer
48 views

Fail2ban does not perform regex on odoo log

I have installed fail2ban with odoo 13. Below are my configuration and sample output, but I cant seem to figure out why it does not filter. user@tempdev:/etc/fail2ban# fail2ban-regex -v /var/log/odoo/...
0
votes
2answers
153 views

centos8 fail2ban not working

I am running fail2ban on CentOS 8 with ssh and Nginx configured. They both are showing ip's being blocked when I do the fail2ban-client status , but they are not actually being blocked by firewalld. ...
1
vote
1answer
222 views

iptables not blocking only IPv6 IP's on Ubuntu 20.04 with iptables-persistent, IPv4 OK

I have Ubuntu 20.04 VPS (LEMP) and installed iptables-persistent. In this server, I have installed fail2ban and configured with CloudFlare to ban fail2ban banned IP's. Also, I use the CSF. I use a ...
1
vote
0answers
378 views

Fail2Ban does not work with nginx HTTP Auth

I'm trying to set up some jails related to Nginx. But I noticed that fail2ban bans the IP with IPTables, but I still can use the form to log in. [sshd] enabled = true filter = sshd maxretry = 3 action ...
2
votes
1answer
59 views

fail2ban : read whitelist from a database

Now I don't know if this is the right place to ask, but I try it. I have a fail2ban running on my server. And I have a whitelist called ignoreip in /etc/fail2ban/jail.conf(I is a list of IPs and masks)...
0
votes
1answer
267 views

Fail2Ban iptables entries to reject HTTPS not stopping requests to Docker container on Amazon Linux 2

I've set up Fail2Ban on Amazon Linux 2, enabling the built-in nginx-http-auth jail with this override config: [nginx-http-auth] enabled = true action = iptables[name=HTTPS, port=https, protocol=tcp] ...
0
votes
0answers
56 views

Change fail2ban.log log level for a rule/filter

Some messages in the fail2ban.log file are set to INFO, where I'd prefer them to be at DEBUG. I don't want some common detail in the logs. For example: fail2ban.filter [214912]: INFO [dovecot] Ignore ...
0
votes
0answers
135 views

How to block HTTPS to IP with iptables and Fail2Ban using X-Forwarded-For

We have an AWS EC2 instance running behind a standard ELB load balancer. Is it possible for iptables to block HTTPS access from certain IPs, using the X-Forwarded-For IP address header info? This rule ...
0
votes
0answers
48 views

Am trying to block certain POST requests with fail2ban

Here are sample POST's type that I am trying to block: "POST /?rcxbq=ate or "POST /?twlwa=ldsm within my apache-post.conf file I have: [INCLUDES] before = common.conf [Definition] ...
0
votes
1answer
69 views

Are my iptables working, as I'm still seeing logs from traffic that should be blocked

Could someone please look at these rules to see if they are doing what they are supposed to be? In particular, the f2b-MALTRAIL one - as this is supposed to be blocking malicious traffic: Chain INPUT (...
1
vote
1answer
217 views

Fail2ban not banning ip address

I installed fail2ban on a Ubuntu 20.04 server. I've followed some articles on how to configure it but it doesn't work. I've made 10 incorrect login attempts and still didn't get banned. /etc/fail2ban/...
-1
votes
1answer
21 views

Postfix - Can Send / Receive Localy - Send External - Not receive from external

I just finish configuring my own mail server using this guide: LinuxBabe Guide At the start all was working but now I can not receive mail from external. Here is my configuration file: https://hatebin....
0
votes
0answers
195 views

Fail2ban overload from long-time-range portscan banning?

Problem I run several filter for f2b, which run fine. However, if I enable my ufw-portscan filter, my server gets problems: f2b starting, stopping, reloading takes long (3min+) f2b frequently hangs ...
0
votes
0answers
68 views

custom fail2ban filter cannot match log

I am trying to match a log by doing a test with fail2ban-regex. I just can't seem to get it right. I've read a lot online but I think my lack of regex or how fail2ban uses it is most likely the ...
0
votes
1answer
46 views

Fail2ban not finding or banning IPs

Fail2ban version v0.10.2 I have a simple jail that looks for a specific user agent. [barkrowler] enabled = true filter = barkrowler logpath = /var/log/apache2/proxy.mydomain.com.access.log port = 80,...
1
vote
1answer
1k views

fail2ban: multiline “failregex” not working

I'm using fail2ban on my debian-8-based host. I have several separate jails for detecting attacks on my SMTP server, and I would like to combine them into one single jail. Each of these jails utilizes ...
1
vote
1answer
137 views

fail2ban txt list creation of banned IP

using fail2ban for years, working nice, would like to automate and harden the security for my router. So I would like that fail2ban created a local file, example, list.txt file with a list of banned ...
0
votes
1answer
157 views

Fail2ban doesn't find log file when launched from SYSTEMCTL but does when launched from CLI

The problem Fail2ban can't find the log file used by a jail when launched with systemctl start fail2ban.service but works perfeclty when launched manually with fail2ban-client start. The stacktrace $ ...
0
votes
1answer
1k views

fail2ban: unban behavior when two jails ban the same IP?

I have two fail2ban jails that deal with postfix: one called postfixsasl and one called postfixauth. They each are looking for different regex matches for triggering bans. It is possible that both of ...
1
vote
0answers
34 views

Create fail2ban filter for custom log

on my website I use monolog, for example to record failed logins in a log. The entries then look like this: 2020-09-25T09:24:22.833648+02:00] Log.ERROR: Failed login attempt, data used: {"...
0
votes
1answer
853 views

fail2ban error with ssh-ddos Unable to read the filter 'sshd-ddos'

I am trying to get fail2ban working with ssh. I have changed the ssh port to 900 and have the following in /etc/fail2ban/jail.local: [sshd] enabled = true port = 900 logpath = %(sshd_log)s This works ...
0
votes
1answer
41 views

fail2ban banning IPs, but iptables is failing to reject them

I'm running Arch with Nginx and fail2ban. I have added this to /etc/fail2ban/filter.d/nginx-dos.conf: # /etc/fail2ban/filter.d/nginx-dos.conf # Fail2Ban configuration file # # Generated on Fri Jun 08 ...
-1
votes
1answer
564 views

Fail2ban + nftables = stderr: 'Error: Could not process rule: No such file or directory'

I've got a problem combining fail2ban and nftables. My setup is "Debian 10 + fail2ban + nftables". At the end there is a problem adding a new rule if someone is banned by fail2ban: 2020-09-...
1
vote
1answer
703 views

fail2ban not banning IPs on Ubuntu 20.04

Ubuntu 20.04. Trying to get fail2ban configured for SSH, but fail2ban not banning any IPs /etc/fail2ban/jail.local [DEFAULT] bantime = 10m ignoreip = 127.0.0.1/8 ##.##.##.##/32 ##.##.##.##/32 findtime ...
0
votes
1answer
154 views

Fail2ban apache-noscript jail violation rules?

Which actions specifically are considered as violating apache noscript fail2ban module? I see that it correctly banned the ip that was looking for strange urls like "/admin" "/login&...
1
vote
0answers
199 views

Do we need Fail2ban for VPN server?

we are using Ubuntu 20.04 LTS vps and running OpenVPN on it. We use certificate key to login to SSHD and the vps is not using any other program(eg. webserver etc). Would you recommend installing and ...
0
votes
1answer
476 views

fail2ban PostgreSQL Filter not working

I use this filter for postgresql: [Definition] failregex = ^<HOST>.+FATAL: password authentication failed for user.+$ ^<HOST>.+FATAL: no pg_hba.conf entry for host .+$ ...
1
vote
1answer
1k views

How does blocking specific ports with fail2ban compare against blocking all ports?

I am setting up fail2ban for my EC2 instances, each of which have different services running. Hence, I am configuring the jails specifically for each service. I have two questions (for which I could ...

1
2 3 4 5
13