Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [fail2ban]

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

0
votes
0answers
28 views

Fail2ban - iptables - clean all fail2ban iptables rules(chains, bans etc.) to prevent duplicate rules

I am using docker in host mode with fail2ban within the docker container, as a result after the container is killed the iptables rules are not killed from the host. An on restart of a docker container ...
1
vote
0answers
8 views

Add postfix fail2ban filter for incorrect auth

I'm trying to add a failregex for Postfix to catch systems sending no correct auth commands. If I receive a line like this: disconnect from unknown[ADDRESS] ehlo=1 auth=0/1 commands=1/2 I'm looking ...
0
votes
0answers
20 views

Sending explicit auth fail requests to fail2ban

From what I understand, fail2ban parses the log files for regexps matching like authentication failure. Is there a way an application can explicitly notify auth failure information like via a REST ...
0
votes
0answers
17 views

Nginx Reverse Proxy block 104 from Error_Log with Fail2ban

I need to ban the following 'Clients' from Nginx Error_Log with fail2ban. 12122#12122: *121212 recv() failed (104: Connection reset by peer) while proxying connection, client: 99.99.99.9, server: 0.0....
0
votes
0answers
22 views

Scan same logs with multiple filters in fail2ban

I've got two different fail2ban filters which implement rate limiting and blocking of bots that visit certain URLs, respectively. I want both to scan the nginx logs. The relevant lines from /etc/...
0
votes
0answers
27 views

fail2ban doesn't find attacker anymore

The IP 218.92.1.158 is currently attacking my Raspberry. Until this morning, fail2ban was blocking it correctly. /etc/fail2ban/jail.local : [DEFAULT] bantime = 3600 findtime = 3600 maxretry = 5 The ...
-1
votes
1answer
19 views

Fail2ban without proactive mode

Is there any way to configure Fail2ban to just log suspicious activities without change my firewall rules?
-2
votes
0answers
26 views

Fail2ban - allow all port *80

I have no knowledge on fail2ban but I have a problem with http connection after a server reboot. I've talked with the server provider and he said that's about the fail2ban which is rejecting the ...
0
votes
1answer
23 views

Fail2Ban Postfix sometimes banning domain names instead of IP addresses in iptables

I'm running an Ubuntu server with Postfix serving as a mail relay. To prevent brute force attacks, I installed Fail2Ban and configured it to look at /var/log/mail.log to ban IPs accordingly. I'm using ...
0
votes
0answers
83 views

fail2ban with docker(host mode networking) is making iptables entry but not stopping connections

Environment: Fail2Ban version - 0.9.6 OS - Debian 9. The issue: Fail2ban is putting entries in iptables as expected for the jail defined in jail.local as: [xyz_failure] enabled=true filter=...
1
vote
1answer
62 views

How to ignore event source log

I have an event source running regularly. The problem is that http-get-dos from fail2ban will catch the IP if the user left the tab open for a large amount of time. So , I am thinking, how can I ...
0
votes
0answers
19 views

Fail2ban regex for postfix SASL errors

In my mail.log I see frequent errors like this: Dec 2 18:07:45 ip-172-26-5-36 postfix/smtpd[32302]: warning: ip112.ip-149-56-254.net[149.56.254.112]: SASL LOGIN authentication failed: Invalid ...
-1
votes
0answers
59 views

fail2ban datepattern not working

I have a log file with a custom date format. I'd love to just change it to a standard format but can't. I managed to get a date pattern format to work with fail2ban-regex, but when I try it in the ...
0
votes
1answer
53 views

fail2ban filter for common apache exploits

Every day I see hackers/script kiddies looking for url's like: /webdav /site.tar /admin /htdocs.php etc. They sometimes hit my sites for several minutes looking for common exploits. Is there a ...
1
vote
0answers
35 views

fail2ban and tomcat8 log filtered localhost_access_log : No such file or directory

this is my first question on serverfault ;) My conf : Debian 9.6, tomcat 8.5.14.0, fail2ban 0.9.6-2 I have created a tomcat8 filter to detect multiple 404 error /etc/fail2ban/filter.d/tomcat.conf ...
1
vote
2answers
56 views

What is a good way to detect DoS and DDoS in Fail2Ban?

I am configuring Fail2Ban on my Ubuntu web server to prevent it from being a victim of DoS / DDoS. I don't want to use Cloudflare because I have to route my DNS over and use their SSl cert. ...
0
votes
0answers
34 views

How can I prevent unwanted GET requests with URLs added to parameters

I have a small ecommerce site, (LEMP stack) and I had used a route like my.domain.com/makecart?return_url=.... as a means of returning to a point in the previous page to assist selection for the ...
0
votes
1answer
34 views

Fail2ban mail customisation

I didn't find where to customise the fail2ban mail messages, i want to change the subject. i know i need to see the action hook like this : action_mwl = %(banaction)s[name=%(__name__)s, port="%(...
2
votes
1answer
189 views

Fail2ban not banning attempted sql injection

I'm getting a large number of sql injection attempts that all look alike on a daily basis. A snippet from the access logs shows: 8222 24.247.182.172 - - [09/Nov/2018:08:47:25 -0600] ***************....
0
votes
1answer
66 views

Fail2ban jail config not working. IP still showing in logs

I am fighting with trying to ban IPs by user agent. It's showing as banned, yet it's still showing up in my logs. In my jail.local [megaindex-crawler-spam] enabled = true filter = megaindex-crawler-...
1
vote
1answer
65 views

fail2ban error with regular expression

I am attempting to ban a specific url in my jail.local configuration. The url is Add_Product.php?union+select <-- Lots more follows this ERROR NOK: ('Unable to compile regular expression \'^(?::...
0
votes
0answers
87 views

fail2ban does not add chain to ip6tables

I am using fail2ban-0.10.2 on Ubuntu 18.04. I have the following action configured in fail2ban, called ipset-simple.local: [Init] protover = 4 iptables = iptables -w blocktype = DROP [Init?family=...
0
votes
0answers
45 views

Fail2ban regex not matching due to date format?

I am trying to configure a regex to prevent brute force and DDOS attacks and I am facing some issues trying to match my regex with the log file. The fail2ban version is 0.8.13. Here is what I am ...
0
votes
0answers
13 views

fial2ban0.9.7 crashing when system.log rotates on macOS10.10.5

I'm trying to install fail2ban0.9.7 (https://github.com/fail2ban/fail2ban/) on a Mac running macOS10.10.5 Yosemite. It is a great program that I run perfectly fine on Unix, Linux and macOS10.6. But ...
0
votes
0answers
35 views

How to set apache-common.local in fail2ban?

I am using CETNOS 7 and fail2ban 0.9.4. As I know,apache error log format can not be changed,then I change access log format to LogFormat "%a %t \"%r\" %>s %O %T \"%{Referer}i\" \"%{User-Agent}i\"" ...
0
votes
0answers
35 views

Can I use `backend = pyinotify` in fail2ban with centos 7?

If using CentOS or Fedora you will need to change the backend option in jail.local from auto to systemd. I read this from this post But I want to set backend = pyinotify in /etc/fail2ban/jail....
2
votes
1answer
63 views

Can I use regex in fail2ban logpath?

I am using CETNOS 7,yum install fail2ban,in /etc/fail2ban/jail.local,I want to set: [DEFAULT] apache_error_log = /var/log/httpd/*error_log /home/websites/.*?/log/errorlog to express: [...
0
votes
0answers
59 views

GeoIP blocking and fail2ban

Both involve adding firewall rules, is it worth implementing fail2ban as well as GeoIP blocking on the same system? Has anyone done this? Is fail2ban left with anything left to do or is it not worth ...
2
votes
1answer
128 views

Fail2ban ufw action does not run when monitoring, but works for manual ban

I'm using fail2ban 0.9.3 on Ubuntu 16.04. My jail.local looks like this: [DEFAULT] banaction = ufw [apache-post] enabled = true filter = apache-post port = http,https logpath = /var/log/apache2/...
0
votes
0answers
92 views

Fail2Ban failregex to block bulk spam from external ips

I need to build a failregex for fail2ban, to block bulk spam from external ips. I would like to build it based on this piece of the log: Oct 4 08:53:08 mail postfix/smtpd[44304]: 401E438E25DC: ...
1
vote
2answers
93 views

Fail2ban is actually failing to ban, but it says it is banning

I've run across a few other articles that show the same exact issue. Here's what my logs are showing from fail2ban: 2018-09-26 22:16:52,286 fail2ban.filter [24743]: INFO [core_404] Found ...
0
votes
1answer
34 views

Fail2ban not working?

I'm trying to use the fail2ban-regex command to test my filter and regex, but it doesn't seem to be having any luck. I used a tutorial to demonstrate how to use the Devise gem with Rails to log failed ...
0
votes
1answer
45 views

Plesk fail2ban regex for mailbox

Can anyone help me with a special f2b Filter to track down recurring login fails on a specific mailbox? i don't want to limit fails to global postfix jail. Therefore i need a extra filter. I also ...
0
votes
1answer
54 views

fail2ban not removing and still running after uninstall

I stopped fail2ban using sudo service fail2ban stop command and I removed fail2ban using sudo apt-get remove fail2ban command but the process is still running. How can I remove and stop fail2ban. Its ...
0
votes
1answer
176 views

Strange behavior with fail2ban when permanently banning IPs

As per documentation, setting jail bantime to a negative value should result in a permanent ban. However once that is done, the following behavior changes, compared to when setting bantime to a ...
0
votes
1answer
25 views

fail2ban distinguish between results for same ip

I need to implement fail2ban in order to secure a server. I would like to scan the logs and ban hosts that generate lots of 404 messages. The problem I have, is that there may be a number of clients ...
0
votes
0answers
88 views

nginx req_limit not triggering fail2ban event (cloudflare api)

like the topic states im trying to setup fail2ban for nginx but im having some problems. I want to watch the req_limit error in the nginx error.log and ban the ip on cloudflare via fail2ban, so no ...
0
votes
1answer
127 views

fail2ban regex with custom nginx log format

Based on this repository I want to use fail2ban filters to analyze my nginx logs and ban suspicious requests and IPs. On my server I'm using a custom log format for nginx. Due to the fact that I'm ...
0
votes
1answer
55 views

Fail2ban only works with log files? [closed]

What about Unix sockets? I have created my own server application that needs protection. My two options: Creating a log file for fail2ban to watch Establish networking between my server application ...
0
votes
1answer
42 views

Identify diffrent nginx 444 in logs to apply certain fail2ban rules

I have some rules in nginx to block trafic: bad bots/user agents, ips, wp-logins. All rules block with return 444 fail2ban is listing nginx logs, but can't diferenciate the rules all rules are 444. ...
0
votes
1answer
71 views

fail2ban filter parsing error

I'm trying to add an extra filter rule to the fail2ban exim filter. I want to catch bad bot attempts that try to send auth too soon. My exim.conf filter's failregex looks like this (with the last ...
0
votes
2answers
908 views

How to block IPs that cause excessive 404 errors with Fail2ban?

I have installed Fail2Ban v0.10.2 on Ubuntu 18.04 with Apache 2.4.29 and enabled the standard ssh and apache jails for basic protection with email notification warnings, when an IP is blocked. Having ...
0
votes
1answer
32 views

What does set logtarget Syslog 2 mean in logrotate.conf file?

I am using latest version of CentOS with NGINX. My Logrotate.conf file has two blocks/directives for fail2ban log (maybe it was a mistake by my previous hosting provider). Therefore, I am receiving ...
2
votes
1answer
367 views

How to create a regular expression for an openvpn fail2ban filter

Some people are trying to get into my openvpn server. For now I'm manually banning each IPs because I don't know how to setup a fail2ban regex. The content below is basically what is found in my /var/...
1
vote
0answers
160 views

fail2ban error: fail2ban-client: ERROR No file(s) found for glob

I installed a server inside docker: logs are mounted in a shared volume with host. In the host i m checking a log file with fail2ban. I can't understand why fail2ban gives this error fail2ban ...
0
votes
1answer
274 views

Using fail2ban to block mysql on localhost

I have fail2ban working on my server and it does ban SSH but I'm having problems banning users trying to access MariaDB using MySQL. I'm also using Adminer which is the main reason why I'm trying to ...
1
vote
1answer
67 views

fail2ban failregex apparently not banning

After noticing repeated attempts to access supposed webadmin resources on my server in blocks by the same ips (i.e. repeated attempts from each ip in a long list of 'common' server webadmin resources, ...
1
vote
0answers
51 views

Block public IPs routed through reverse proxy

I have setup my router to port forward traffic from a specific port to a server acting as a reverse proxy. The server is based on CentOS 7 with Apache 2.4.6. One of my backend servers is also CentOS ...
-1
votes
3answers
425 views

Fail2ban unban action fails with Cloudflare

I'm trying to setup Cloudflare blocking with fail2ban using this guide and while it bans the IP correctly, fail2ban cannot unban the IP from Cloudflare either after timeout or with manual shell ...
0
votes
0answers
236 views

fail2ban permanently ban IP based on directory access

First question here. I am getting tons of requests in my apache error log trying to find files in directories that does not exist. And I am thinking, this is annoying but also a honeypot opportunity....