Questions tagged [fail2ban]
Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.
701
questions
1
vote
1
answer
53
views
Fail2Ban - Match Asterisk PJSIP Successful Authentication
I'm trying to create a fail2ban filter that will match successful authentications. An example log entry looks like this:
[2023-05-25 18:41:00] VERBOSE[26149] res_pjsip/pjsip_options.c: Contact user/...
- 377
0
votes
0
answers
20
views
Filtering Amazon servers by IP range AND URL
My server is often attacked by bots hosted on Amazon servers.
So I configured iptables to block the largest ip ranges from Amazon.
My problem is that let's encrypt use also Amazon servers to issue new ...
1
vote
0
answers
24
views
Fail2ban Auto Whitelist
We use fail2ban on a number of our servers for blocking brute-force attempts against services like SSH, SMTP, IMAP, SIP, etc, and it works very well. However, we get a lot of false positives under ...
- 377
0
votes
0
answers
57
views
fail2ban block plex failed login attempts
I want to ban IPs who attempt to authenticate against my public Plex instance.
Im on Ubuntu and the log Im looking at is the following:
/var/lib/plexmediaserver/Library/Application\ Support/Plex\ ...
- 101
0
votes
0
answers
17
views
fail2ban matches regular expressions but does not ban
I'm trying to set up fail2ban to monitor our traefik access logs but I'm not getting fail2ban to actually ban anything even though fail2ban-regex shows a lot of matches.
I've also specified loglevel = ...
- 101
0
votes
0
answers
83
views
fail2ban ssh not banning any IP
I started fail2ban service as sudo systemctl restart fail2ban.service, it successfully started.
But my ssh attempts with the wrong password from remote PCs are not blocking, There is no IP listed in ...
- 1
0
votes
1
answer
119
views
fail2ban ipset proper setup of jail.conf
My understanding is that running Fail2ban using ipset is faster. To that end:
I downloaded and installed per instructions (modified for Fedora 37) ritsu/ipset-fail2ban from Git.
My banaction is still ...
- 3
0
votes
1
answer
39
views
How to make an regex in Fail2ban with ip:port
First of all, English is not mu native language, so if I make a mistake don't shoot me. :)
Here's my problem: when I use every thing works fine, as soon as there is a port number or a comma direct ...
- 1
1
vote
2
answers
158
views
Fail2ban ban action error on debian
I'm not sure where to start looking for the issue here
This is on debian 11 (using nftables)
It seems like the nft add set ... command is failing
nft add set inet f2b-table addr-set-wordpress \{ type ...
- 121
0
votes
0
answers
83
views
Fail2ban regex not banning IP address
I have the following jail added to jail.local file:
[nginx-honeypot]
enabled = true
filter = nginx-honeypot
port = http,https
logpath = /var/log/nginx/access.log
maxretry = 1
bantime = 86400
I ...
- 119
0
votes
1
answer
63
views
hardening fail2ban using systemd sandbox
I've been trying to follow the ArchWiki instructions on hardening Fail2Ban:
https://wiki.archlinux.org/title/Fail2ban#Service_hardening
Specifically I've created a drop-in file as described and ...
- 193
0
votes
0
answers
44
views
fail2ban regex failing to work
I am trying to create a regex for my fail2ban filter to block all IPs that get a incorrect login on a web application. The way I distinguish this is that each login generates a GET request in the ...
- 15
0
votes
0
answers
10
views
Fail2ban failregex didn't detect
I'm getting a lot of error messages with the following:
Received From: server->/var/log/syslog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the ...
- 115
0
votes
0
answers
70
views
fail2ban inside official MariaDB docker image
I am running a docker image mariadb:10.9.2-jammy
I noticed with that I get a lot of brute force logging attempts cluttering my logs when I do docker logs mariadb
Is it possible to implement something ...
- 57
0
votes
1
answer
41
views
fail2ban: how to combine multiple failregex?
I'm having problems with adding multiple failregex lines in my jail.local file. It works if I have one line but doesn't work if I have two.
This is my my jail.local config:
[sshd]
enabled = true
...
- 115
-1
votes
1
answer
134
views
what the meaning of "logpath = %(nginx_error_log)s" in fail2ban jail log path?
I am running fail2ban on Ubuntu 20.04 server, and am looking over some of the default jails. In [nginx-http-auth] the default log path shows as logpath = %(nginx_error_log)s. What exactly does %(...
- 113
0
votes
0
answers
164
views
Zimbra Webmail not blocking with Fail2ban
I have had troubles with Fail2Ban and was wondering if anyone else has seen this and been able to overcome it.
I have two Fail2ban rules in place for Zimbra, one for SMTP and the other for Webmail. ...
- 1
1
vote
1
answer
508
views
Using fail2ban in a docker container to block incomming connections
I am trying to use fail2ban in a docker-container to block incoming connections to my nextcloud (also running in a docker container). However I only can get fail2ban to change the iptables of its own ...
0
votes
0
answers
66
views
Fail2Ban redirect instead of drop
I'm trying to configure Fail2ban to redirect instead of banning, I've found plenty of posts about redirecting to a different port for HTTP traffic to display a different webpage, but I need to ...
0
votes
2
answers
86
views
fail2ban - one IP banned multiple times by multiple jails - errors in log durin unbanning
I make few similar jails for different ports...
jail names: http_https_deny, dns_deny, ftp_deny, smtp_pop3_deny, ssh_deny
here firewalld and fail2ban settings for http_https_deny(other almost same, ...
0
votes
0
answers
137
views
How to modify fail2ban filter for openvpn to fit the DD-WRT logs in /tmp/var/log/messages?
I just installed Entware, on a DD-WRT router running openvpn server. I am trying to install a proper openvpn /opt/etc/fail2ban/filter.d/openvpn.conf filter for fail2ban, but am having problems ...
- 113
0
votes
1
answer
62
views
Matching log entry with custon Fail2ban regex
I'm running Fail2ban on a Raspberry Pi 3 with Buster. Fail2ban version v0.10.2. One applicaton on it is running a simple python HTTP server script.
I'm trying to match this kind of record from the ...
- 23
0
votes
1
answer
81
views
fail2ban doesnt work (Ubuntu/SSH)
i installed fail2ban it doesnt work im trying all the day to configure jail.conf..
this is my jail.conf(yes i changed the original one, my fault...)
enabled = true
port = ssh
filter = sshd
logpath =...
- 1
0
votes
1
answer
126
views
fail2ban works with access logs but not error logs "Have not found any log file" Bitnami Servers
OK I am stumped...Why is it that fail2ban works perfectly fine on my ubuntu computer but on my aws bitnami stack it won't find the error_log file. It's like it hates the fact that bitnami puts the ...
- 103
0
votes
2
answers
378
views
fail2ban log activity even if IP has been banned anyway
I would like to know if there is a way to know if a banned IP is still trying to contact my server and what is he trying to do?
The fail2ban.log seems to show who has been banned, but not if a banned ...
- 3
0
votes
0
answers
110
views
Fail2ban make a custom fail regex filter for Nginx error log
I am new to regex. How do I write a Fail2Ban filter to match with these nxinx error log lines?
2022/11/30 00:46:19 [crit] 57811#57811: *8911 SSL_do_handshake() failed (SSL: error:141CF06C:SSL routines:...
0
votes
1
answer
46
views
fail2ban - changing banaction not working as expected
I am using fail2ban to mitigate attacks on my webservers (Ubuntu 18.04lts). This is working really well, but recently I've noticed a growing trend of returning attacks. So I added a new rule for these:...
- 20.3k
1
vote
0
answers
88
views
fail2ban ingest IPs from AbuseIPDB
In the same way, we report IPs for AbuseIPDB IPs, is there a way to use their DB of IPs to Ban IPS using fail2ban?
I went through this tutorial
https://www.abuseipdb.com/fail2ban.html
And it works to ...
- 111
0
votes
0
answers
74
views
banning IPs from file in Fail2ban
I've installed fail2ban and it's working fine in banning IPs that try to access ssh with invalid username/password even if they tried once.
Now I'm receiving key exchange attacks that fail2ban doesn't ...
- 3
0
votes
0
answers
168
views
fail2ban doesn't react to multiple ip's in log file, while fail2ban-regex - does
Several days of fighting.
My configuration is SME server 10 and fail2ban version 0.11.2.
I run:
fail2ban-regex /var/log/httpd/access_log apache-get-dos.conf :
Running tests
Use failregex filter file ...
- 101
0
votes
0
answers
24
views
Fail2Ban filter for Apache GSSAPI module
Does someone know if there is a Fail2Ban filter for Apache GSSAPI Module Authentication (mod_auth_gssapi)?
The Fail2Ban "apache-auth.conf" filter seems not working for this kind of ...
- 101
0
votes
1
answer
66
views
Loading fail2ban filters from subdirectory
Is it possible for fail2ban to load filters from a folder within /etc/fail2ban/filters? For instance, if I set up a file at /etc/fail2ban/filters/custom/log4j.conf, could I load that filter in my jail....
- 217
0
votes
0
answers
126
views
fail2ban and uwf: openvpn is not blocked
I'm trying to block invalid openvpn connections with fail2ban and ufw. It seems that fail2ban works like expected:
/> grep "86.236.232.215" /var/log/fail2ban.log
2022-09-13 13:46:41,312 ...
- 979
0
votes
1
answer
460
views
nginxproxymanager fail2ban for 401
I've setup nginxproxymanager and would like to use fail2ban for security. I'm very new to fail2ban need advise from y'all.
My access log when login failed as below
[12/Sep/2022:09:47:54 +0000] - 401 ...
- 1
0
votes
1
answer
67
views
fail2ban does not ban one address
all. I just installed fail2ban 0.11.2 and it seems to run. All settings are default.
Looking into its log file I see that from qpsmtpd analysis there is one address which it doesn't want to ban, ...
- 101
0
votes
0
answers
13
views
sendmail is giving errors of sm-mta [duplicate]
I am using the service called fail2ban and configured mail address over there to receive mails when a intruder is triggered.But I am not receiving mails. I see the below errors.
What exactly is ...
0
votes
0
answers
112
views
fail2ban apache error log filtering
I have hosting server with fail2ban as a security daemon.
Currently I cannot figure out working regex for fail2ban apache error log.
Example log line:
2022-08-19 02:10:44.361090 [INFO] [2787] [T0] [...
- 1
0
votes
1
answer
224
views
Simple and secure way to display error page with IP address of visitor? With python?
Fail2ban is used to block users on certain patterns via reject command.
Sometimes, especially when users are behind a NAT with a lot of users they get blocked unintendely. The user then writes an E-...
- 307
0
votes
0
answers
147
views
Fail2Ban blocking everything on every port, no access
I copied the jail.conf to jail.local and used the Default jail to block IPs on every port with the default bantime etc. I also changed "enabled" to true.
After restarting the service, I was ...
2
votes
1
answer
255
views
How to send a systemd ssh error so that it's picked by fail2ban
I have a setup which uses ansible and vagrant to test a custom role which installs and configures fail2ban.
I have written myself a simple test playbook which uses the fail2ban role and applies the ...
- 1,488
0
votes
1
answer
988
views
Fail2Ban - Posfix-SASL not working
i have a problem that my fail2ban will not ban sasl authentications against my postfix.
This is an example log entry from /var/log/syslog:
Jul 31 13:42:21 v50428 postfix/smtps/smtpd[635398]: warning: ...
- 21
0
votes
1
answer
227
views
Blocking tor traffic with postfix or fail2ban on mailserver
I am running an Ubuntu 20.04 Lemp server, with postfix/dovecot. I have fail2ban set up so that if 2 unsuccessful loging attempts to my email are made by the same ip address, fail2ban bans the ip's ...
- 113
0
votes
0
answers
124
views
Migrated JAILs from TrueNAS 11.3 to JAILS over FreeBSD 13 with VNET and now IPFW inside JAIL not work: kldload ipfw - not permitted
In jail under TrueNAS 11, was mail server that can block IPs by IPFW rules.
Now I move JAIL to FreeBSD 13.1, and detect that same JAIL with same settings, not allow to load IPFW inside jail.
kldload ...
- 14
-3
votes
1
answer
232
views
I need a script to ptint output from fail2ban
I installed Fail2ban and it's working fine.
I'm NOT a Linux guru, sorry. I can just about find my way around.
I need a script that will print all banned IP addresses and most important the DATE AND ...
- 1
0
votes
0
answers
74
views
Fail2ban asterisk directly ban
I have the following fail2ban asterisk settings set.
[asterisk]
port = 5060,5061
action_ = %(default/action_)s[name=%(__name__)s-tcp, protocol="tcp"]
%(default/action_)s[...
- 1
0
votes
1
answer
188
views
Fail2ban : regex used in failregex does not work (square brackets ] issue ?!)
With fail2ban, I want to ban IPs based to the content of apache_access.log file.
This is an example of line I want match with regex rules :
197.221.254.56 - - [13/Jun/2022:22:59:59 +0200] "GET / ...
- 107
1
vote
1
answer
387
views
fail2ban not creating jails in CentOS
I'm trying to create a jail in Fail2Ban to protect a Asterisk PBX.
I already did as suggested and made a copy of jail.conf named jail.local. In jail.local, I set up a asterisk jail as follows:
[...
- 11
0
votes
1
answer
322
views
Editing fail2ban apache-noscript config to add "AH10244: invalid URI path"
I have the following (default) /etc/fail2ban/filter.d/apache-noscript.conf configuration file:
[Definition]
script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl|\bcgi-bin/)
prefregex = ^%(...
- 83
0
votes
1
answer
190
views
fail2ban iptables returned 200, iptables 0 references
I installed fail2ban but on start I got multiple error messages:
iptables -n -L gives me 0 references for each jail. (should be 1?)
Chain INPUT (policy ACCEPT)
target prot opt source ...
- 115
0
votes
1
answer
705
views
fail2ban appears to be working but server still receives connection attempts
fail2ban mistery!
Everything seems to be working and well configured but server still receives connection attempts.
[moso@matrix ~]$ sudo systemctl status fail2ban
● fail2ban.service - Fail2Ban ...
- 1