Questions tagged [fail2ban]

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

Filter by
Sorted by
Tagged with
-1 votes
1 answer
77 views

fail2ban cannot block ip public, it works only for private ip

My server live behind the reverse proxy nginx, but the ip of the client access shows in the apache log like this, looks normal, there is no x-forward things in the log. 103.221.234.206 - - [28/Feb/...
Riska K A's user avatar
0 votes
1 answer
189 views

Trying to understand if fail2ban is working on Debian 10 VPS

I have a Debian 10 server running on a VPS. The only software I installed is: tinyproxy (http proxy) and fail2ban I have included the results of port scan using nmap I have included my specific ...
xstack's user avatar
  • 105
0 votes
1 answer
52 views

Fail2Ban RegEx works but filter does not

my plan is to ban all accesses to my webserver which repeatedly produce 404-errors and obviously do some scanning only For this I tried fail2ban-regex /var/log/apache2/otheraccess.log '^<HOST>. -...
Elmi's user avatar
  • 101
0 votes
2 answers
101 views

Fail2Ban: RegEx to filter all 404 errors out of the Apache-log

In my logs I regularly see loads of 404-errors where bots obviously do scan the server systematically for specific software installations. As this also causes loads of traffic, I want to ban them. So ...
Elmi's user avatar
  • 101
0 votes
0 answers
83 views

firewalld and iptables | fail2ban

I have fail2ban 1.0.2 running on an Almalinux server. Seems to be working as hoped, but I'm puzzled by something. have sshd.local and 00-firewalld.local in jail.d (installed fail2ban and fail2ban-...
Johnny Canuck's user avatar
0 votes
1 answer
203 views

fail2ban include list of ip addresses to ban

Suppose I have a .txt file containing a list of ip addresses I'd like to ban for some amount of time (so, a blacklist file of some sort). I know how do do this in Apache (for example) - simply by ...
Johnny Canuck's user avatar
1 vote
0 answers
31 views

iptables ignores REJECT in custom chain but works in the main chain

I configured a server with fail2ban for the smtp server. Now, fail2ban correctly bans the IPs and I can see them in the iptables chain of fail2ban. However, the kernel seems to ignore the iptables ...
ocirocir's user avatar
  • 113
0 votes
1 answer
116 views

fail2ban | difference between [sshd] in jail.local, vs sshd.local in jail.d?

AlmaLinux server -- 1.0.2 fail2ban installed. Seems to be working, but, am hoping someone can clarify something for me: 1\ working with jail.local copy of jail.conf. In said jail.local, there is a ...
Johnny Canuck's user avatar
0 votes
1 answer
54 views

Is firewalld needed by fail2ban?

When I install fail2ban, it also installs firewalld. After a reboot, firewalld also starts, enforcing settings on the iptables (dropping most connections accept ssh). This is frustrating as I want to ...
Thomas Stokes's user avatar
-1 votes
1 answer
79 views

fail2ban Jail starts but no connections are showed

I installed fail2ban on my Ubuntu server. It seems to starts fine: cat fail2ban.log 2023-12-07 14:55:27,758 fail2ban.server [803]: INFO -------------------------------------------------- ...
João Sacramento's user avatar
1 vote
1 answer
879 views

Issue with sshd logfile using fail2ban on minimal Ubuntu server 22.04

I am working on trying to get fail2ban set up and enabled for sshd on my VPS with Ionos. I am using a minimal Ubuntu 22.04 server install. fail2ban has installed fine, but getting it to run seems a ...
Sorin Orii's user avatar
1 vote
1 answer
109 views

fail2ban ignores <HOST> IP address and bans all incoming traffic

I'm trying to enable fail2ban on Centos 7 with Apache. I have an app which writes to the error log a specific string when login fails. responds with the right IP address in the Banned IP list, > ...
Ami Heines's user avatar
0 votes
0 answers
97 views

fail2ban jail is not respected

I'm completely new to fail2ban. I implemented a custom filter and a custom jail to ban some users from accessing my website which is hosted by apache. Fail2ban seems to recognize my regex fail rules ...
learningtech's user avatar
  • 7,445
0 votes
0 answers
56 views

fail2ban missed lines in my filter

I am completely new to using fail2ban. Right now I am getting a missed line error but I cannot figure out why. I have the following two files: // /etc/fail2ban/filter.d/apache-custom.conf [...
learningtech's user avatar
  • 7,445
-1 votes
1 answer
272 views

Crafting regex for Fail2ban and NGINX

I'm having some trouble understanding how to craft a regex to capture probe attempts on my nginx webserver. I would like to craft a filter to catch sites hitting certain files (by name) and/or by php ...
Thystra's user avatar
0 votes
0 answers
62 views

Fail2ban rule not working, nginx basic auth

I have a regexp like this that is used in my fail2ban jail ^ \[error\] \d+#\d+: \*\d+ user "\S+":? (password mismatch|was not found in ".*"), client: <HOST>, server: \S+, ...
sblantipodi's user avatar
0 votes
0 answers
199 views

How to correctly remove entries from firewalld ipset runtime?

Running Debian 12 I have created an IPSet in the following manner: ~$ firewall-cmd --permanent --new-ipset=myipset --type=hash:ip --option=timeout=0 success ~$ firewall-cmd --reload success ~$ ...
John David Ravenscroft's user avatar
0 votes
1 answer
73 views

Retrieve URL / Request in a fail2ban action with nginx

I have configured fail2ban to block spam attempts with nginx. everything works but I would like to be able to retrieve the url / domain visited in my actions. recovering the “logpath” also suits me ...
guillaumearnx's user avatar
0 votes
1 answer
123 views

Banning an IP address (or subnet) on Debian (still connecting after ufw and iptables)

I know the subject of banning IP addresses have been covered multiple times but for some reason I'm failing to address/identify this one. I am trying to identify a problem with random attacks of some ...
omega1's user avatar
  • 446
0 votes
1 answer
173 views

Unable to configure fail2ban to protect samba shares

With this configuration service (fail2ban) starts, logfile register wrong attempts, but still not count attempts in fail2ban-client. I suspect that there is a problem with regex, but this is the only ...
Ivan's user avatar
  • 1
0 votes
1 answer
124 views

Creating an IPTABLES chain, whose rules are ignored, unless the packet is from a certain port?

I want to confirm the following. If I create a chain whose first rule is: iptables -I INPUT -p tcp -m multiport --dports 25,465 -j name Does that mean that any further specified rules in the chain, ...
user1993015's user avatar
0 votes
1 answer
248 views

Fail2ban accepted the customized jail but it did not detect the event

this problem drives me crazy. I configured a jail to prevent excessive http post to my web server. Seems the fail2ban server accepts my new jail but nothing takes effective in the fail2ban server. ...
mzzhmh's user avatar
  • 1
0 votes
1 answer
95 views

iptables string matching feasability; possible use with fail2ban

We have several Apache 2.4 web servers behind a load balancer and CDN front end - where HTTPS is terminated - we see the client IP in headers from the front end in the back end Apache logs. I'm ...
Special Monkey's user avatar
0 votes
2 answers
329 views

fail2ban on host for rootless podman keycloak container

running on Rocky Linux 9.2 with podman 4.4.1. I got a podman Pod with keycloak + postgresql inside, running rootless. The pod itself with --network 'slirp4netns:port_handler=slirp4netns'. The keycloak ...
Leo's user avatar
  • 141
0 votes
1 answer
415 views

Fail2ban apache2 access log regex

Can anyone help me with fail2ban regex My goal is to ban any accessing .env or .php files or any request that starts with "wp-", it is a little bit confusing and another to detect invalid ...
Joukhar's user avatar
  • 103
0 votes
2 answers
258 views

Apache Log files Fail2ban and WordPress

I am trying to get Fail2ban to block brute force and persistent xmlrpc and wp-login attacks on a WordPress site. I have an issue with the apache logging filenames. Getting past selinux issues was ...
jon_the_eye's user avatar
0 votes
1 answer
94 views

fail2ban is working but not getting email to show that sshd-ddos is running

I have fail2ban running on my server and I have three programs running: sshd, sshd-ddos and runcloud-agent. There are no error messages but when I recently restarted my server, I got an email message ...
Gregory Schultz's user avatar
0 votes
1 answer
67 views

Does iptables apply all rules in order when an incoming connection is received?

I'm using iptables and fail2ban to secure server connections. Currently I have connections filtered via a router passing only ports for email and webserver access and fail2ban adding restrictions ...
Max's user avatar
  • 3
0 votes
2 answers
173 views

Unable to compile regular expression in Fail2Ban

I'm trying to get this regex working in Fail2Ban: SRC=(?<ADDR>.*) DST.*(?=DPT=5003) In a regex tester it's working very fine. When testing in Fail2Ban, I get this error: ERROR: Unable to ...
error401's user avatar
0 votes
1 answer
132 views

Using fail2ban to scan for SSH Accepted Connections and write the username to auth.log

I have a small server that authenticate users as root using their ssh-keys stored in authorized_keys file. I also run fail2ban. I made a convention to have a nickname written after the public_key of ...
meldirlobor's user avatar
0 votes
1 answer
203 views

linux fail2ban not catching auth a specific fail with postfix

I had journalctl open and noticed an offender repeatedly hitting me with auth fails in postfix. I have a standard postfix-sasl filter on by default that, to my knowledge, is working well. It wasn't ...
gstlouis's user avatar
  • 119
1 vote
1 answer
174 views

Fail2Ban - Match Asterisk PJSIP Successful Authentication

I'm trying to create a fail2ban filter that will match successful authentications. An example log entry looks like this: [2023-05-25 18:41:00] VERBOSE[26149] res_pjsip/pjsip_options.c: Contact user/...
Nick Coons's user avatar
0 votes
0 answers
68 views

Filtering Amazon servers by IP range AND URL

My server is often attacked by bots hosted on Amazon servers. So I configured iptables to block the largest ip ranges from Amazon. My problem is that let's encrypt use also Amazon servers to issue new ...
Fabrice Kimmel's user avatar
2 votes
1 answer
315 views

Fail2ban Auto Whitelist

We use fail2ban on a number of our servers for blocking brute-force attempts against services like SSH, SMTP, IMAP, SIP, etc, and it works very well. However, we get a lot of false positives under ...
Nick Coons's user avatar
0 votes
0 answers
489 views

fail2ban block plex failed login attempts

I want to ban IPs who attempt to authenticate against my public Plex instance. Im on Ubuntu and the log Im looking at is the following: /var/lib/plexmediaserver/Library/Application\ Support/Plex\ ...
Deac Karns's user avatar
0 votes
0 answers
179 views

fail2ban matches regular expressions but does not ban

I'm trying to set up fail2ban to monitor our traefik access logs but I'm not getting fail2ban to actually ban anything even though fail2ban-regex shows a lot of matches. I've also specified loglevel = ...
Rasmus's user avatar
  • 101
1 vote
1 answer
632 views

fail2ban ssh not banning any IP

I started fail2ban service as sudo systemctl restart fail2ban.service, it successfully started. But my ssh attempts with the wrong password from remote PCs are not blocking, There is no IP listed in ...
zaheerk's user avatar
  • 11
0 votes
1 answer
530 views

fail2ban ipset proper setup of jail.conf

My understanding is that running Fail2ban using ipset is faster. To that end: I downloaded and installed per instructions (modified for Fedora 37) ritsu/ipset-fail2ban from Git. My banaction is still ...
WSpivak's user avatar
0 votes
1 answer
182 views

How to make an regex in Fail2ban with ip:port

First of all, English is not mu native language, so if I make a mistake don't shoot me. :) Here's my problem: when I use every thing works fine, as soon as there is a port number or a comma direct ...
Storm's user avatar
  • 1
1 vote
2 answers
942 views

Fail2ban ban action error on debian

I'm not sure where to start looking for the issue here This is on debian 11 (using nftables) It seems like the nft add set ... command is failing nft add set inet f2b-table addr-set-wordpress \{ type ...
Michael T's user avatar
  • 121
0 votes
0 answers
357 views

Fail2ban regex not banning IP address

I have the following jail added to jail.local file: [nginx-honeypot] enabled = true filter = nginx-honeypot port = http,https logpath = /var/log/nginx/access.log maxretry = 1 bantime = 86400 I ...
adam78's user avatar
  • 119
0 votes
1 answer
225 views

hardening fail2ban using systemd sandbox

I've been trying to follow the ArchWiki instructions on hardening Fail2Ban: https://wiki.archlinux.org/title/Fail2ban#Service_hardening Specifically I've created a drop-in file as described and ...
Sam Mason's user avatar
  • 193
0 votes
0 answers
71 views

fail2ban regex failing to work

I am trying to create a regex for my fail2ban filter to block all IPs that get a incorrect login on a web application. The way I distinguish this is that each login generates a GET request in the ...
ServerMan's user avatar
0 votes
0 answers
158 views

fail2ban inside official MariaDB docker image

I am running a docker image mariadb:10.9.2-jammy I noticed with that I get a lot of brute force logging attempts cluttering my logs when I do docker logs mariadb Is it possible to implement something ...
jotyhista's user avatar
0 votes
1 answer
302 views

fail2ban: how to combine multiple failregex?

I'm having problems with adding multiple failregex lines in my jail.local file. It works if I have one line but doesn't work if I have two. This is my my jail.local config: [sshd] enabled = true ...
Gregory Schultz's user avatar
0 votes
1 answer
810 views

what the meaning of "logpath = %(nginx_error_log)s" in fail2ban jail log path?

I am running fail2ban on Ubuntu 20.04 server, and am looking over some of the default jails. In [nginx-http-auth] the default log path shows as logpath = %(nginx_error_log)s. What exactly does %(...
DanRan's user avatar
  • 123
1 vote
1 answer
2k views

Using fail2ban in a docker container to block incomming connections

I am trying to use fail2ban in a docker-container to block incoming connections to my nextcloud (also running in a docker container). However I only can get fail2ban to change the iptables of its own ...
Felix Schneider's user avatar
0 votes
0 answers
133 views

Fail2Ban redirect instead of drop

I'm trying to configure Fail2ban to redirect instead of banning, I've found plenty of posts about redirecting to a different port for HTTP traffic to display a different webpage, but I need to ...
BruceLeeRoy's user avatar
0 votes
2 answers
197 views

fail2ban - one IP banned multiple times by multiple jails - errors in log durin unbanning

I make few similar jails for different ports... jail names: http_https_deny, dns_deny, ftp_deny, smtp_pop3_deny, ssh_deny here firewalld and fail2ban settings for http_https_deny(other almost same, ...
it_buddha's user avatar
0 votes
1 answer
153 views

Matching log entry with custon Fail2ban regex

I'm running Fail2ban on a Raspberry Pi 3 with Buster. Fail2ban version v0.10.2. One applicaton on it is running a simple python HTTP server script. I'm trying to match this kind of record from the ...
RDK's user avatar
  • 23

1
2 3 4 5
15