Questions tagged [fail2ban]
Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.
722
questions
0
votes
2
answers
206
views
fail2ban - one IP banned multiple times by multiple jails - errors in log durin unbanning
I make few similar jails for different ports...
jail names: http_https_deny, dns_deny, ftp_deny, smtp_pop3_deny, ssh_deny
here firewalld and fail2ban settings for http_https_deny(other almost same, ...
0
votes
1
answer
153
views
Matching log entry with custon Fail2ban regex
I'm running Fail2ban on a Raspberry Pi 3 with Buster. Fail2ban version v0.10.2. One applicaton on it is running a simple python HTTP server script.
I'm trying to match this kind of record from the ...
0
votes
1
answer
458
views
fail2ban doesnt work (Ubuntu/SSH)
i installed fail2ban it doesnt work im trying all the day to configure jail.conf..
this is my jail.conf(yes i changed the original one, my fault...)
enabled = true
port = ssh
filter = sshd
logpath =...
0
votes
1
answer
872
views
fail2ban works with access logs but not error logs "Have not found any log file" Bitnami Servers
OK I am stumped...Why is it that fail2ban works perfectly fine on my ubuntu computer but on my aws bitnami stack it won't find the error_log file. It's like it hates the fact that bitnami puts the ...
0
votes
2
answers
1k
views
fail2ban log activity even if IP has been banned anyway
I would like to know if there is a way to know if a banned IP is still trying to contact my server and what is he trying to do?
The fail2ban.log seems to show who has been banned, but not if a banned ...
0
votes
1
answer
157
views
fail2ban - changing banaction not working as expected
I am using fail2ban to mitigate attacks on my webservers (Ubuntu 18.04lts). This is working really well, but recently I've noticed a growing trend of returning attacks. So I added a new rule for these:...
1
vote
0
answers
147
views
fail2ban ingest IPs from AbuseIPDB
In the same way, we report IPs for AbuseIPDB IPs, is there a way to use their DB of IPs to Ban IPS using fail2ban?
I went through this tutorial
https://www.abuseipdb.com/fail2ban.html
And it works to ...
0
votes
1
answer
188
views
Loading fail2ban filters from subdirectory
Is it possible for fail2ban to load filters from a folder within /etc/fail2ban/filters? For instance, if I set up a file at /etc/fail2ban/filters/custom/log4j.conf, could I load that filter in my jail....
0
votes
1
answer
777
views
nginxproxymanager fail2ban for 401
I've setup nginxproxymanager and would like to use fail2ban for security. I'm very new to fail2ban need advise from y'all.
My access log when login failed as below
[12/Sep/2022:09:47:54 +0000] - 401 ...
0
votes
1
answer
83
views
fail2ban does not ban one address
all. I just installed fail2ban 0.11.2 and it seems to run. All settings are default.
Looking into its log file I see that from qpsmtpd analysis there is one address which it doesn't want to ban, ...
0
votes
1
answer
387
views
Simple and secure way to display error page with IP address of visitor? With python?
Fail2ban is used to block users on certain patterns via reject command.
Sometimes, especially when users are behind a NAT with a lot of users they get blocked unintendely. The user then writes an E-...
0
votes
0
answers
325
views
Fail2Ban blocking everything on every port, no access
I copied the jail.conf to jail.local and used the Default jail to block IPs on every port with the default bantime etc. I also changed "enabled" to true.
After restarting the service, I was ...
2
votes
1
answer
943
views
How to send a systemd ssh error so that it's picked by fail2ban
I have a setup which uses ansible and vagrant to test a custom role which installs and configures fail2ban.
I have written myself a simple test playbook which uses the fail2ban role and applies the ...
0
votes
1
answer
2k
views
Fail2Ban - Posfix-SASL not working
i have a problem that my fail2ban will not ban sasl authentications against my postfix.
This is an example log entry from /var/log/syslog:
Jul 31 13:42:21 v50428 postfix/smtps/smtpd[635398]: warning: ...
0
votes
1
answer
432
views
Blocking tor traffic with postfix or fail2ban on mailserver
I am running an Ubuntu 20.04 Lemp server, with postfix/dovecot. I have fail2ban set up so that if 2 unsuccessful loging attempts to my email are made by the same ip address, fail2ban bans the ip's ...
-3
votes
1
answer
438
views
I need a script to ptint output from fail2ban
I installed Fail2ban and it's working fine.
I'm NOT a Linux guru, sorry. I can just about find my way around.
I need a script that will print all banned IP addresses and most important the DATE AND ...
0
votes
1
answer
300
views
Fail2ban : regex used in failregex does not work (square brackets ] issue ?!)
With fail2ban, I want to ban IPs based to the content of apache_access.log file.
This is an example of line I want match with regex rules :
197.221.254.56 - - [13/Jun/2022:22:59:59 +0200] "GET / ...
1
vote
1
answer
659
views
fail2ban not creating jails in CentOS
I'm trying to create a jail in Fail2Ban to protect a Asterisk PBX.
I already did as suggested and made a copy of jail.conf named jail.local. In jail.local, I set up a asterisk jail as follows:
[...
0
votes
1
answer
530
views
Editing fail2ban apache-noscript config to add "AH10244: invalid URI path"
I have the following (default) /etc/fail2ban/filter.d/apache-noscript.conf configuration file:
[Definition]
script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl|\bcgi-bin/)
prefregex = ^%(...
0
votes
1
answer
296
views
fail2ban iptables returned 200, iptables 0 references
I installed fail2ban but on start I got multiple error messages:
iptables -n -L gives me 0 references for each jail. (should be 1?)
Chain INPUT (policy ACCEPT)
target prot opt source ...
0
votes
1
answer
1k
views
fail2ban appears to be working but server still receives connection attempts
fail2ban mistery!
Everything seems to be working and well configured but server still receives connection attempts.
[moso@matrix ~]$ sudo systemctl status fail2ban
● fail2ban.service - Fail2Ban ...
0
votes
1
answer
287
views
fail2ban not banning but matches logs
I try to create a brute force protection with fail2ban. With the fail2ban test, it matches the logs I wanna match but with my test brute forcing the site with 7+ failed logins, it does not ban my ip ...
0
votes
1
answer
65
views
sendmail and pacemaker require different /etc/hosts
Trying to make run sendmail (required by fail2ban, or it takes forever to start-stop-restart it) and pacemaker on one machine.
Sendmail wants machine's hostname resolved as 127.0.0.1, pacemaker - as ...
0
votes
2
answers
666
views
fail2ban not banning "matched" IPs from vsftp log
Using fail2ban to secure the vsftp login:
jail.local
[vsftpd]
enabled = true
bantime = 600
findtime = 5000
maxretry = 1
port = ftp,ftp-data
action = iptables-multiport
logpath = /var/log/vsftpd/...
0
votes
1
answer
152
views
Is it necessary to ban malicious IP regardless of default firewall setting being deny/reject?
I'm on Linux and using fail2ban as the ban system. So far, it has collected and banned about 150K of malicious IPs, and I'm concerned and wondering if this will gobble a fair amount of resources. As I ...
1
vote
2
answers
2k
views
can fail2ban add deny rules to nginx instead of using iptables
I'm having one server, that is behind a reverse proxy, that I don't control.
I'd like to use fail2ban to block nginx traffic under certain conditions.
normally fail2ban useses iptables to block ...
1
vote
2
answers
2k
views
block nginx connection after multiple 404 s on same tcp connection
I'd like to protect two servers against attackers who blindly probe for urls.
my idea is to block requests after a certain amount of 404 status codes.
I could do this with fail2ban.
However one of the ...
0
votes
1
answer
1k
views
fail2ban: apache-badbots is not working
I have a working fail2ban configuration which not only blocks IPs but also announces them to the AbuseIPDB. This is working fine for sshd and postfix-sasl, but not for apache-badbots (and resultign ...
1
vote
1
answer
3k
views
Fail2ban bantime.increment not working
I wanted to increase the bantime of repeat offenders getting caught by fail2ban. I added the following lines at the top of /etc/fail2ban/jail.local and fail2ban.local
[DEFAULTS]
bantime.increment = ...
0
votes
1
answer
556
views
Backtesting Historical Logs in fail2ban
Setup
I'm running apache on an ubuntu server. I've created a fail2ban rule which bans an ip when they request too many pages too fast.
# Fail2ban Rule
failregex = ^.*?(:80|:443) <HOST> - .* &...
0
votes
1
answer
277
views
Bot detection by fail2ban
I want to know if it is possible to use in fail2ban some rule / script that detects the bots, not just by maxretry in a given amount in seconds, but through identifying some patterns for every IP:
for ...
0
votes
1
answer
4k
views
fail2ban fails to add iptables to rules
I'm having issues with fail2ban is not adding the banned IP to iptables.
this is the error;
2022-01-29 15:13:48,499 fail2ban.actions [2608]: NOTICE [man] Restore Ban 212.192.246.26
2022-01-29 ...
0
votes
1
answer
1k
views
How to create failregex to block imap-logins fail2ban
Could someone help me with creating correct fail2ban filter.
Bad ip addresses knocking port 993
/etc/fail2ban/filter.d/dovecot.conf doesn't catch such log
I found something like this, but i get errors ...
-2
votes
1
answer
747
views
FAIL2BAN filters- who can give me filter to block this intrusion?
I see in my mediatemple server maillog endless intrusion. i need to block these ips.
who can help with filter file to match these?
Jan 21 07:51:44 mydomain postfix/smtpd[23505]: SSL_accept error from ...
1
vote
3
answers
2k
views
FAIL2BAN filters. Any filter for this intrusion by internet search scanners?
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: connection established
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: master_notify: status 0
Jan 19 22:49:00 intelligent-...
0
votes
1
answer
1k
views
Use value of <F-USER> from fail2ban regex
I am trying to send e-mail to me and user that someone tried to login to their ssh and failed - the IP got banned. But I don't understand how can I use the variable in the e-mail I am trying to send.
...
0
votes
1
answer
670
views
Failed to restart fail2ban.service: Unit firehol.service not found
When you come accorss this error after uninstalling Firehol. Check that you don't have this block:
[Unit]
# Starting fail2ban will automatically start firehol before it.
# Stopping firehol will ...
1
vote
1
answer
385
views
Implement fail2ban to prevent brute force attack on a web site (using standard user authentication); work when the number of tries = maxretry+1
I am working on an course assignment to implement fail2ban to prevent brute force attack on a web site (using standard user authentication). I have set up my apache web server as well as fail2ban ...
1
vote
1
answer
1k
views
Enabling PHPMYADMIN Logging & Fail2ban Default Filter
I am on Debian 10.5 LAMP with ISPConfig, running PHPMYADMIN 4.9.0.1.
I installed phpmyadmin following this tutorial I can only guess that somehow ISPConfig may be interrupting something.
In any case, ...
0
votes
0
answers
569
views
Is it worth it to install and configure fail2ban for an Bind9 authoritative DNS server?
In our project infrastructure we have a nameserver, based on bind9. This nameserver is configured as primary and authoritative, so it is quite important. The question is, should I install and ...
1
vote
1
answer
1k
views
fail2ban - Additional regex for sshd filter
I am currently trying to catch failed SSH login attempts with certificate based authentication (certificate correct but wrong password) using fail2ban version 0.11.2-2 (running on Debian 11).
...
1
vote
2
answers
2k
views
HINT on 127: "Command not found" fail2ban
I have a problem with Fail2ban. In the log I have this:
2021-12-05 00:49:23,968 fail2ban.utils [979765]: ERROR 7f9a6df8cdf0 -- stderr: '/bin/sh: 1: iptables: not found'
2021-12-05 00:49:23,...
0
votes
1
answer
80
views
Which protections can I use on the server
I have read about server protection and I know how to work with fewalld protection because it is not demanding.
My question is:
Which of the following protections is best for the server and which of ...
0
votes
0
answers
166
views
Fail2Ban not sending IP to iptables
Fail2Ban seems to be working fine
Status for the jail: nginx-php
|- Filter
| |- Currently failed: 1
| |- Total failed: 22
| `- File list: /var/log/nginx/access.log
`- Actions
|- Currently ...
2
votes
1
answer
2k
views
Fail2ban filter for error 400 on nginx
I have a nginx server I am hosting very base php website (school club) and log file show lot of weird requests how do I block them. I tried using fail2ban but my filters were not accurate.
nginx-400....
3
votes
2
answers
1k
views
My custom fail2ban jail fails to load even though fail2ban-regex suggests that it should work?
I've written a custom jail and filter in fail2ban for logging into my service. The log file is located in /var/log/motion/motion.log and a failed login generates a line like this:
[0:ml1] [ALR] [STR] [...
1
vote
1
answer
3k
views
Creating a custom filter for fail2ban
I'm trying to create a custom jail and filter in fail2ban for motion stream http authentication. The log directory is /var/log/motion/motion.log and a failed login attempt generates:
[0:ml1] [ALR] [...
4
votes
1
answer
3k
views
Fail2ban ipset - which conf to use?
I have read that iptables can be slow in case of large number of ip addresses and ipset is more preferred in that scenario. I would like to use ipset banaction but there are at least 3 of them, ...
0
votes
1
answer
2k
views
fail2ban does not work for ssh except on port 22
My fail2ban is not working for sshd except for the default port 22/tcp.
My old, working config in jail.local:
[sshd]
enabled = true
port = ssh
Tested fail2ban, did ban me after 3 failed attempts ...
0
votes
1
answer
502
views
Can fail2ban-client tell me if an ip from a CIDR range is in a jail? [duplicate]
If I have a CIDR like 13.54.63.128/26 can fail2ban-client tell me if there's an IP in this range that's currently banned?
Currently I'm doing:
CIDR="13.54.63.128/26"
nmap -sL -n $CIDR | awk '...