Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [fail2ban]

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

0
votes
0answers
17 views

fail2ban error with regular expression

I am attempting to ban a specific url in my jail.local configuration. The url is Add_Product.php?union+select <-- Lots more follows this ERROR NOK: ('Unable to compile regular expression \'^(?::...
0
votes
0answers
13 views

fail2ban does not add chain to ip6tables

I am using fail2ban-0.10.2 on Ubuntu 18.04. I have the following action configured in fail2ban, called ipset-simple.local: [Init] protover = 4 iptables = iptables -w blocktype = DROP [Init?family=...
0
votes
0answers
25 views

Fail2ban regex not matching due to date format?

I am trying to configure a regex to prevent brute force and DDOS attacks and I am facing some issues trying to match my regex with the log file. The fail2ban version is 0.8.13. Here is what I am ...
0
votes
0answers
10 views

fial2ban0.9.7 crashing when system.log rotates on macOS10.10.5

I'm trying to install fail2ban0.9.7 (https://github.com/fail2ban/fail2ban/) on a Mac running macOS10.10.5 Yosemite. It is a great program that I run perfectly fine on Unix, Linux and macOS10.6. But ...
0
votes
0answers
10 views

How to set apache-common.local in fail2ban?

I am using CETNOS 7 and fail2ban 0.9.4. As I know,apache error log format can not be changed,then I change access log format to LogFormat "%a %t \"%r\" %>s %O %T \"%{Referer}i\" \"%{User-Agent}i\"" ...
0
votes
0answers
12 views

Can I use `backend = pyinotify` in fail2ban with centos 7?

If using CentOS or Fedora you will need to change the backend option in jail.local from auto to systemd. I read this from this post But I want to set backend = pyinotify in /etc/fail2ban/jail....
2
votes
1answer
21 views

Can I use regex in fail2ban logpath?

I am using CETNOS 7,yum install fail2ban,in /etc/fail2ban/jail.local,I want to set: [DEFAULT] apache_error_log = /var/log/httpd/*error_log /home/websites/.*?/log/errorlog to express: [...
0
votes
0answers
17 views

GeoIP blocking and fail2ban

Both involve adding firewall rules, is it worth implementing fail2ban as well as GeoIP blocking on the same system? Has anyone done this? Is fail2ban left with anything left to do or is it not worth ...
2
votes
0answers
36 views

Fail2ban ufw action does not run when monitoring, but works for manual ban

I'm using fail2ban 0.9.3 on Ubuntu 16.04. My jail.local looks like this: [DEFAULT] banaction = ufw [apache-post] enabled = true filter = apache-post port = http,https logpath = /var/log/apache2/...
0
votes
0answers
35 views

Fail2Ban failregex to block bulk spam from external ips

I need to build a failregex for fail2ban, to block bulk spam from external ips. I would like to build it based on this piece of the log: Oct 4 08:53:08 mail postfix/smtpd[44304]: 401E438E25DC: ...
1
vote
2answers
70 views

Fail2ban is actually failing to ban, but it says it is banning

I've run across a few other articles that show the same exact issue. Here's what my logs are showing from fail2ban: 2018-09-26 22:16:52,286 fail2ban.filter [24743]: INFO [core_404] Found ...
0
votes
1answer
28 views

Fail2ban not working?

I'm trying to use the fail2ban-regex command to test my filter and regex, but it doesn't seem to be having any luck. I used a tutorial to demonstrate how to use the Devise gem with Rails to log failed ...
0
votes
1answer
33 views

Plesk fail2ban regex for mailbox

Can anyone help me with a special f2b Filter to track down recurring login fails on a specific mailbox? i don't want to limit fails to global postfix jail. Therefore i need a extra filter. I also ...
0
votes
1answer
28 views

fail2ban not removing and still running after uninstall

I stopped fail2ban using sudo service fail2ban stop command and I removed fail2ban using sudo apt-get remove fail2ban command but the process is still running. How can I remove and stop fail2ban. Its ...
0
votes
1answer
46 views

Strange behavior with fail2ban when permanently banning IPs

As per documentation, setting jail bantime to a negative value should result in a permanent ban. However once that is done, the following behavior changes, compared to when setting bantime to a ...
0
votes
1answer
23 views

fail2ban distinguish between results for same ip

I need to implement fail2ban in order to secure a server. I would like to scan the logs and ban hosts that generate lots of 404 messages. The problem I have, is that there may be a number of clients ...
0
votes
0answers
33 views

nginx req_limit not triggering fail2ban event (cloudflare api)

like the topic states im trying to setup fail2ban for nginx but im having some problems. I want to watch the req_limit error in the nginx error.log and ban the ip on cloudflare via fail2ban, so no ...
0
votes
1answer
58 views

fail2ban regex with custom nginx log format

Based on this repository I want to use fail2ban filters to analyze my nginx logs and ban suspicious requests and IPs. On my server I'm using a custom log format for nginx. Due to the fact that I'm ...
0
votes
1answer
55 views

Fail2ban only works with log files? [closed]

What about Unix sockets? I have created my own server application that needs protection. My two options: Creating a log file for fail2ban to watch Establish networking between my server application ...
0
votes
1answer
27 views

Identify diffrent nginx 444 in logs to apply certain fail2ban rules

I have some rules in nginx to block trafic: bad bots/user agents, ips, wp-logins. All rules block with return 444 fail2ban is listing nginx logs, but can't diferenciate the rules all rules are 444. ...
0
votes
1answer
34 views

fail2ban filter parsing error

I'm trying to add an extra filter rule to the fail2ban exim filter. I want to catch bad bot attempts that try to send auth too soon. My exim.conf filter's failregex looks like this (with the last ...
0
votes
2answers
341 views

How to block IPs that cause excessive 404 errors with Fail2ban?

I have installed Fail2Ban v0.10.2 on Ubuntu 18.04 with Apache 2.4.29 and enabled the standard ssh and apache jails for basic protection with email notification warnings, when an IP is blocked. Having ...
0
votes
1answer
22 views

What does set logtarget Syslog 2 mean in logrotate.conf file?

I am using latest version of CentOS with NGINX. My Logrotate.conf file has two blocks/directives for fail2ban log (maybe it was a mistake by my previous hosting provider). Therefore, I am receiving ...
2
votes
1answer
186 views

How to create a regular expression for an openvpn fail2ban filter

Some people are trying to get into my openvpn server. For now I'm manually banning each IPs because I don't know how to setup a fail2ban regex. The content below is basically what is found in my /var/...
1
vote
0answers
89 views

fail2ban error: fail2ban-client: ERROR No file(s) found for glob

I installed a server inside docker: logs are mounted in a shared volume with host. In the host i m checking a log file with fail2ban. I can't understand why fail2ban gives this error fail2ban ...
0
votes
1answer
168 views

Using fail2ban to block mysql on localhost

I have fail2ban working on my server and it does ban SSH but I'm having problems banning users trying to access MariaDB using MySQL. I'm also using Adminer which is the main reason why I'm trying to ...
1
vote
1answer
37 views

fail2ban failregex apparently not banning

After noticing repeated attempts to access supposed webadmin resources on my server in blocks by the same ips (i.e. repeated attempts from each ip in a long list of 'common' server webadmin resources, ...
1
vote
0answers
44 views

Block public IPs routed through reverse proxy

I have setup my router to port forward traffic from a specific port to a server acting as a reverse proxy. The server is based on CentOS 7 with Apache 2.4.6. One of my backend servers is also CentOS ...
-1
votes
3answers
297 views

Fail2ban unban action fails with Cloudflare

I'm trying to setup Cloudflare blocking with fail2ban using this guide and while it bans the IP correctly, fail2ban cannot unban the IP from Cloudflare either after timeout or with manual shell ...
0
votes
0answers
204 views

fail2ban permanently ban IP based on directory access

First question here. I am getting tons of requests in my apache error log trying to find files in directories that does not exist. And I am thinking, this is annoying but also a honeypot opportunity....
0
votes
1answer
164 views

fail2ban does not start up on ubuntu 16

I installed fail2ban on ubuntu 16 on which I also have ufw. I copied jail.conf to jail.local in /etc/fail2ban. After this, I tried starting fail2ban but I get the following error in the logs (using ...
-2
votes
1answer
104 views

unable to jail ssh fail2ban 0.9.6

I am on Centos 6.9 with fail2ban 0.9.6. I have the below SSH jail but after restarting fail2ban it is not enabled when running fail2ban-client status. The conf I used is /etc/fail2ban/jail.local. I ...
-1
votes
3answers
171 views

nginx - Is this a bad bot? [closed]

I have these entries in /var/log/nginx/access.log: 107.155.152.109 - - [22/Mar/2018:19:20:54 +0000] "GET / HTTP/1.0" 301 193 "-" "-" 162.216.152.56 - - [22/Mar/2018:19:21:40 +0000] "GET / HTTP/1.0" ...
0
votes
0answers
207 views

sshd.conf fail2ban not banning cipher / key exchange

I have frequent attempts to use ssh cipher or key exchange to compromise our system. (from /var/log/auth.log) Mar 7 18:48:00 smb sshd[15022]: fatal: Unable to negotiate with 103.99.2.190 port 64720: ...
0
votes
1answer
71 views

Should I remove the ipv6 of my server from trusted IPs of fail2ban v0.9? [closed]

I have new Plesk Onyx server with CentOS 7. I installed the Fail2ban component (the version installed is v0.9.6). In the fail2ban.log I see a lot of warnings like this: WARNING Unable to find a ...
1
vote
1answer
164 views

fail2ban regex matching on testing sites, but not fail2ban itself

Hi so I'm trying to match the following log line: E/Sun, 04 Mar 2018 21:40:32 +0100: Error logging in from RemoteIP: 1.2.3.4 And after many hours I've finally got a regex that works on debuggerex, ...
1
vote
0answers
840 views

fail2ban does not seem to ban an IP after repeated failed ssh login attempts

I'm trying to figure out why Fail2Ban doesn't seem to be doing anything on my server. This is an Ubuntu 14.04 server: $ lsb_release -a No LSB modules are available. Distributor ID: Ubuntu ...
1
vote
1answer
412 views

Enabling fail2ban 0.10 on ipv6

I just upgraded to fail2ban version 0.10 on debian via apt-get. I see things like this in 'iptables -n -L': Chain f2b-apache-auth (1 references) ... Chain f2b-pam-generic (1 references) ... but I ...
0
votes
1answer
120 views

iptables rules dissappear when manually adding a nat rule to iptables-persistent file

I noticed that about two-thirds of the rules I have specified in /etc/iptables/rules.v4 stopped showing in sudo iptables -S after I added a nat rule. (I isolated the disappearance to adding this one ...
0
votes
1answer
137 views

Troubleshooting a problematic IPTABLE rule

Background I am very new to Fail2Ban, UFW, and IPTABLES. The rules in place on the VM in question, were mostly generated automatically. Some I added after following instructions for such. One is ...
-1
votes
1answer
163 views

fail2ban-regex <HOST> filter missed

quick question regarding fail2ban filter regex problem I have a log pattern: 2018-02-06 07:40:20,954 fail2ban.actions [26058]: NOTICE [postfix-sasl] Ban 192.168.2.14 I try to Ban IP (192.168.2.14) ...
0
votes
1answer
399 views

How can I get nginx-botsearch of Fail2Ban to match a string but also not match that same string if it has additional trailing characters?

System is Ubuntu 16.04. Using fail2ban from the package manager (which is currently 0.9.3-1). Have enabled nginx-botsearch in jail.local. Here is my /etc/fail2ban/filter.d/nginx-botsearch.local (note ...
0
votes
0answers
125 views

fail2ban inside lxc container, gets error message

I want to run fail2ban inside an unprivileged lxc-container (named testc2, debian stretch), but get the following error message root@testc2:/# service fail2ban start Job for fail2ban.service failed ...
0
votes
0answers
88 views

How can i use fail2ban when using mod_wsgi with django?

Fail2ban blocks access based on the contents of apache errorlog, a classic error log line will contain the ip address to ban, but when using django applications (apache and mod_wsgi) the errorlog ...
0
votes
1answer
350 views

fail2ban hanging on creating SSL Certificates all day

I tried installing fail2ban today on my ubuntu 16.04 server. It seemed to install correctly. Unfortunately, this command has been running now for over 3 hours. Creating/Updating SSL(for TLS) ...
0
votes
1answer
521 views

fail2ban cannot set iptables rules

I have only a thin knowledge of both iptables and fail2ban, but my mail server has a lot of incoming connections that I want to get rid of. I have this config block in /etc/fail2ban/jail.conf [...
0
votes
1answer
214 views

fail2ban - Filter IPs by cidr blocks

I'm using fail2ban 0.10.0 and with it I'm able to trigger some actions to block bruteforce attempts from a given single origin (with the HOST tag). But suppose someone has control over an entire /24 ...
0
votes
1answer
168 views

Understanding fail2ban mechanisms

Apache 2.4 Fail2ban 0.9.6 Jail.local [with_ip_only] Maxretry = 3 Findtime = 600 Bantime= 60000 Banaction = iptables-allports I have this guy [46.xxx] scanning my server and I’m wondering why ...
2
votes
1answer
217 views

Configuring an alternate jail in fail2ban for manual use

I have a fail2ban instance that works well. But I also like to occasionally examine the logs manually and try to ID system probes that are working around my standard f2b definitions. What I'm ...
0
votes
0answers
138 views

How to add CDN ip address on the whitelist of fail2ban?

Im using KEYCDN on my wordpress blog. I use also fail2ban with the jail /wp-login My problem is the CDN server tries many times to POST on my wordpress website on the login page /wp-login.php which ...