Questions tagged [fail2ban]

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

Filter by
Sorted by
Tagged with
0 votes
2 answers
206 views

fail2ban - one IP banned multiple times by multiple jails - errors in log durin unbanning

I make few similar jails for different ports... jail names: http_https_deny, dns_deny, ftp_deny, smtp_pop3_deny, ssh_deny here firewalld and fail2ban settings for http_https_deny(other almost same, ...
it_buddha's user avatar
0 votes
1 answer
153 views

Matching log entry with custon Fail2ban regex

I'm running Fail2ban on a Raspberry Pi 3 with Buster. Fail2ban version v0.10.2. One applicaton on it is running a simple python HTTP server script. I'm trying to match this kind of record from the ...
RDK's user avatar
  • 23
0 votes
1 answer
458 views

fail2ban doesnt work (Ubuntu/SSH)

i installed fail2ban it doesnt work im trying all the day to configure jail.conf.. this is my jail.conf(yes i changed the original one, my fault...) enabled = true port = ssh filter = sshd logpath =...
MKDE's user avatar
  • 1
0 votes
1 answer
872 views

fail2ban works with access logs but not error logs "Have not found any log file" Bitnami Servers

OK I am stumped...Why is it that fail2ban works perfectly fine on my ubuntu computer but on my aws bitnami stack it won't find the error_log file. It's like it hates the fact that bitnami puts the ...
waltmagic's user avatar
  • 103
0 votes
2 answers
1k views

fail2ban log activity even if IP has been banned anyway

I would like to know if there is a way to know if a banned IP is still trying to contact my server and what is he trying to do? The fail2ban.log seems to show who has been banned, but not if a banned ...
dkdlv's user avatar
  • 3
0 votes
1 answer
157 views

fail2ban - changing banaction not working as expected

I am using fail2ban to mitigate attacks on my webservers (Ubuntu 18.04lts). This is working really well, but recently I've noticed a growing trend of returning attacks. So I added a new rule for these:...
symcbean's user avatar
  • 22.4k
1 vote
0 answers
147 views

fail2ban ingest IPs from AbuseIPDB

In the same way, we report IPs for AbuseIPDB IPs, is there a way to use their DB of IPs to Ban IPS using fail2ban? I went through this tutorial https://www.abuseipdb.com/fail2ban.html And it works to ...
mario ruiz's user avatar
0 votes
1 answer
188 views

Loading fail2ban filters from subdirectory

Is it possible for fail2ban to load filters from a folder within /etc/fail2ban/filters? For instance, if I set up a file at /etc/fail2ban/filters/custom/log4j.conf, could I load that filter in my jail....
mattbd's user avatar
  • 227
0 votes
1 answer
777 views

nginxproxymanager fail2ban for 401

I've setup nginxproxymanager and would like to use fail2ban for security. I'm very new to fail2ban need advise from y'all. My access log when login failed as below [12/Sep/2022:09:47:54 +0000] - 401 ...
niaosuan's user avatar
0 votes
1 answer
83 views

fail2ban does not ban one address

all. I just installed fail2ban 0.11.2 and it seems to run. All settings are default. Looking into its log file I see that from qpsmtpd analysis there is one address which it doesn't want to ban, ...
leonp's user avatar
  • 101
0 votes
1 answer
387 views

Simple and secure way to display error page with IP address of visitor? With python?

Fail2ban is used to block users on certain patterns via reject command. Sometimes, especially when users are behind a NAT with a lot of users they get blocked unintendely. The user then writes an E-...
Hannes's user avatar
  • 327
0 votes
0 answers
325 views

Fail2Ban blocking everything on every port, no access

I copied the jail.conf to jail.local and used the Default jail to block IPs on every port with the default bantime etc. I also changed "enabled" to true. After restarting the service, I was ...
Ratatouille1945's user avatar
2 votes
1 answer
943 views

How to send a systemd ssh error so that it's picked by fail2ban

I have a setup which uses ansible and vagrant to test a custom role which installs and configures fail2ban. I have written myself a simple test playbook which uses the fail2ban role and applies the ...
tftd's user avatar
  • 1,540
0 votes
1 answer
2k views

Fail2Ban - Posfix-SASL not working

i have a problem that my fail2ban will not ban sasl authentications against my postfix. This is an example log entry from /var/log/syslog: Jul 31 13:42:21 v50428 postfix/smtps/smtpd[635398]: warning: ...
nils50122's user avatar
0 votes
1 answer
432 views

Blocking tor traffic with postfix or fail2ban on mailserver

I am running an Ubuntu 20.04 Lemp server, with postfix/dovecot. I have fail2ban set up so that if 2 unsuccessful loging attempts to my email are made by the same ip address, fail2ban bans the ip's ...
DanRan's user avatar
  • 123
-3 votes
1 answer
438 views

I need a script to ptint output from fail2ban

I installed Fail2ban and it's working fine. I'm NOT a Linux guru, sorry. I can just about find my way around. I need a script that will print all banned IP addresses and most important the DATE AND ...
Mikheil's user avatar
0 votes
1 answer
300 views

Fail2ban : regex used in failregex does not work (square brackets ] issue ?!)

With fail2ban, I want to ban IPs based to the content of apache_access.log file. This is an example of line I want match with regex rules : 197.221.254.56 - - [13/Jun/2022:22:59:59 +0200] "GET / ...
spacecodeur's user avatar
1 vote
1 answer
659 views

fail2ban not creating jails in CentOS

I'm trying to create a jail in Fail2Ban to protect a Asterisk PBX. I already did as suggested and made a copy of jail.conf named jail.local. In jail.local, I set up a asterisk jail as follows: [...
GD1's user avatar
  • 11
0 votes
1 answer
530 views

Editing fail2ban apache-noscript config to add "AH10244: invalid URI path"

I have the following (default) /etc/fail2ban/filter.d/apache-noscript.conf configuration file: [Definition] script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl|\bcgi-bin/) prefregex = ^%(...
dan's user avatar
  • 83
0 votes
1 answer
296 views

fail2ban iptables returned 200, iptables 0 references

I installed fail2ban but on start I got multiple error messages: iptables -n -L gives me 0 references for each jail. (should be 1?) Chain INPUT (policy ACCEPT) target prot opt source ...
user1031743's user avatar
0 votes
1 answer
1k views

fail2ban appears to be working but server still receives connection attempts

fail2ban mistery! Everything seems to be working and well configured but server still receives connection attempts. [moso@matrix ~]$ sudo systemctl status fail2ban ● fail2ban.service - Fail2Ban ...
Moso's user avatar
  • 1
0 votes
1 answer
287 views

fail2ban not banning but matches logs

I try to create a brute force protection with fail2ban. With the fail2ban test, it matches the logs I wanna match but with my test brute forcing the site with 7+ failed logins, it does not ban my ip ...
Sebastian's user avatar
0 votes
1 answer
65 views

sendmail and pacemaker require different /etc/hosts

Trying to make run sendmail (required by fail2ban, or it takes forever to start-stop-restart it) and pacemaker on one machine. Sendmail wants machine's hostname resolved as 127.0.0.1, pacemaker - as ...
yu-boot's user avatar
0 votes
2 answers
666 views

fail2ban not banning "matched" IPs from vsftp log

Using fail2ban to secure the vsftp login: jail.local [vsftpd] enabled = true bantime = 600 findtime = 5000 maxretry = 1 port = ftp,ftp-data action = iptables-multiport logpath = /var/log/vsftpd/...
mathewCorn's user avatar
0 votes
1 answer
152 views

Is it necessary to ban malicious IP regardless of default firewall setting being deny/reject?

I'm on Linux and using fail2ban as the ban system. So far, it has collected and banned about 150K of malicious IPs, and I'm concerned and wondering if this will gobble a fair amount of resources. As I ...
BigRat's user avatar
  • 1
1 vote
2 answers
2k views

can fail2ban add deny rules to nginx instead of using iptables

I'm having one server, that is behind a reverse proxy, that I don't control. I'd like to use fail2ban to block nginx traffic under certain conditions. normally fail2ban useses iptables to block ...
gelonida's user avatar
  • 279
1 vote
2 answers
2k views

block nginx connection after multiple 404 s on same tcp connection

I'd like to protect two servers against attackers who blindly probe for urls. my idea is to block requests after a certain amount of 404 status codes. I could do this with fail2ban. However one of the ...
gelonida's user avatar
  • 279
0 votes
1 answer
1k views

fail2ban: apache-badbots is not working

I have a working fail2ban configuration which not only blocks IPs but also announces them to the AbuseIPDB. This is working fine for sshd and postfix-sasl, but not for apache-badbots (and resultign ...
Elmi's user avatar
  • 101
1 vote
1 answer
3k views

Fail2ban bantime.increment not working

I wanted to increase the bantime of repeat offenders getting caught by fail2ban. I added the following lines at the top of /etc/fail2ban/jail.local and fail2ban.local [DEFAULTS] bantime.increment = ...
Whip's user avatar
  • 260
0 votes
1 answer
556 views

Backtesting Historical Logs in fail2ban

Setup I'm running apache on an ubuntu server. I've created a fail2ban rule which bans an ip when they request too many pages too fast. # Fail2ban Rule failregex = ^.*?(:80|:443) <HOST> - .* &...
Patrick32123's user avatar
0 votes
1 answer
277 views

Bot detection by fail2ban

I want to know if it is possible to use in fail2ban some rule / script that detects the bots, not just by maxretry in a given amount in seconds, but through identifying some patterns for every IP: for ...
gugu's user avatar
  • 1
0 votes
1 answer
4k views

fail2ban fails to add iptables to rules

I'm having issues with fail2ban is not adding the banned IP to iptables. this is the error; 2022-01-29 15:13:48,499 fail2ban.actions [2608]: NOTICE [man] Restore Ban 212.192.246.26 2022-01-29 ...
Adam Larsson's user avatar
0 votes
1 answer
1k views

How to create failregex to block imap-logins fail2ban

Could someone help me with creating correct fail2ban filter. Bad ip addresses knocking port 993 /etc/fail2ban/filter.d/dovecot.conf doesn't catch such log I found something like this, but i get errors ...
kusjev's user avatar
  • 1
-2 votes
1 answer
747 views

FAIL2BAN filters- who can give me filter to block this intrusion?

I see in my mediatemple server maillog endless intrusion. i need to block these ips. who can help with filter file to match these? Jan 21 07:51:44 mydomain postfix/smtpd[23505]: SSL_accept error from ...
alex K's user avatar
  • 11
1 vote
3 answers
2k views

FAIL2BAN filters. Any filter for this intrusion by internet search scanners?

Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: connection established Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: master_notify: status 0 Jan 19 22:49:00 intelligent-...
alex K's user avatar
  • 11
0 votes
1 answer
1k views

Use value of <F-USER> from fail2ban regex

I am trying to send e-mail to me and user that someone tried to login to their ssh and failed - the IP got banned. But I don't understand how can I use the variable in the e-mail I am trying to send. ...
Hynek Bernard's user avatar
0 votes
1 answer
670 views

Failed to restart fail2ban.service: Unit firehol.service not found

When you come accorss this error after uninstalling Firehol. Check that you don't have this block: [Unit] # Starting fail2ban will automatically start firehol before it. # Stopping firehol will ...
Abe's user avatar
  • 123
1 vote
1 answer
385 views

Implement fail2ban to prevent brute force attack on a web site (using standard user authentication); work when the number of tries = maxretry+1

I am working on an course assignment to implement fail2ban to prevent brute force attack on a web site (using standard user authentication). I have set up my apache web server as well as fail2ban ...
CKSoon's user avatar
  • 11
1 vote
1 answer
1k views

Enabling PHPMYADMIN Logging & Fail2ban Default Filter

I am on Debian 10.5 LAMP with ISPConfig, running PHPMYADMIN 4.9.0.1. I installed phpmyadmin following this tutorial I can only guess that somehow ISPConfig may be interrupting something. In any case, ...
Maestro223's user avatar
0 votes
0 answers
569 views

Is it worth it to install and configure fail2ban for an Bind9 authoritative DNS server?

In our project infrastructure we have a nameserver, based on bind9. This nameserver is configured as primary and authoritative, so it is quite important. The question is, should I install and ...
hancack's user avatar
  • 21
1 vote
1 answer
1k views

fail2ban - Additional regex for sshd filter

I am currently trying to catch failed SSH login attempts with certificate based authentication (certificate correct but wrong password) using fail2ban version 0.11.2-2 (running on Debian 11). ...
flowks's user avatar
  • 11
1 vote
2 answers
2k views

HINT on 127: "Command not found" fail2ban

I have a problem with Fail2ban. In the log I have this: 2021-12-05 00:49:23,968 fail2ban.utils [979765]: ERROR 7f9a6df8cdf0 -- stderr: '/bin/sh: 1: iptables: not found' 2021-12-05 00:49:23,...
juju750xx's user avatar
0 votes
1 answer
80 views

Which protections can I use on the server

I have read about server protection and I know how to work with fewalld protection because it is not demanding. My question is: Which of the following protections is best for the server and which of ...
Edgar's user avatar
  • 17
0 votes
0 answers
166 views

Fail2Ban not sending IP to iptables

Fail2Ban seems to be working fine Status for the jail: nginx-php |- Filter | |- Currently failed: 1 | |- Total failed: 22 | `- File list: /var/log/nginx/access.log `- Actions |- Currently ...
Salim Aljayousi's user avatar
2 votes
1 answer
2k views

Fail2ban filter for error 400 on nginx

I have a nginx server I am hosting very base php website (school club) and log file show lot of weird requests how do I block them. I tried using fail2ban but my filters were not accurate. nginx-400....
Aron's user avatar
  • 21
3 votes
2 answers
1k views

My custom fail2ban jail fails to load even though fail2ban-regex suggests that it should work?

I've written a custom jail and filter in fail2ban for logging into my service. The log file is located in /var/log/motion/motion.log and a failed login generates a line like this: [0:ml1] [ALR] [STR] [...
KacperNoe's user avatar
1 vote
1 answer
3k views

Creating a custom filter for fail2ban

I'm trying to create a custom jail and filter in fail2ban for motion stream http authentication. The log directory is /var/log/motion/motion.log and a failed login attempt generates: [0:ml1] [ALR] [...
KacperNoe's user avatar
4 votes
1 answer
3k views

Fail2ban ipset - which conf to use?

I have read that iptables can be slow in case of large number of ip addresses and ipset is more preferred in that scenario. I would like to use ipset banaction but there are at least 3 of them, ...
mezano's user avatar
  • 43
0 votes
1 answer
2k views

fail2ban does not work for ssh except on port 22

My fail2ban is not working for sshd except for the default port 22/tcp. My old, working config in jail.local: [sshd] enabled = true port = ssh Tested fail2ban, did ban me after 3 failed attempts ...
itarill's user avatar
  • 103
0 votes
1 answer
502 views

Can fail2ban-client tell me if an ip from a CIDR range is in a jail? [duplicate]

If I have a CIDR like 13.54.63.128/26 can fail2ban-client tell me if there's an IP in this range that's currently banned? Currently I'm doing: CIDR="13.54.63.128/26" nmap -sL -n $CIDR | awk '...
jaygooby's user avatar
  • 324

1
2
3 4 5
15