Questions tagged [fail2ban]

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.

Filter by
Sorted by
Tagged with
14 votes
5 answers
8k views

Is it worth the effort to block failed login attempts

Is it worthwhile running fail2ban, sshdfilter or similar tools, which blacklist IP addresses which attempt and fail to login? I've seen it argued that this is security theatre on a "properly secured"...
dunxd's user avatar
  • 9,704
304 votes
17 answers
735k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
psp's user avatar
  • 3,303
39 votes
5 answers
84k views

In Fail2Ban, How to Change the SSH port number?

In my server, the ssh port is not the standard 22. I have set a different one. If I setup fail2ban, will it be able to detect that port? How can I tell it to check that port rather than port 22? The ...
THpubs's user avatar
  • 1,775
33 votes
1 answer
38k views

How to set up fail2ban to read multi log in a jail?

How can I configure multiple logpaths for the same rule? I'm trying to write a syntax like this: [apache-w00tw00t] enabled = true filter = apache-w00tw00t action = iptables-allports logpath = /...
Max121's user avatar
  • 353
15 votes
3 answers
28k views

How do I setup monitoring of MySQL with Fail2ban?

Searching the internet with search engines on MySQL and fail2ban yields lots of results on putting your fail2ban logs into MySQL, however I'm wanting to monitor failed MySQL attempts to log in and ban ...
InvisibleFrisbee's user avatar
15 votes
3 answers
12k views

Fail2Ban Correctly Attempts to Ban IP but IP does not get banned - iptables chain exists but not working

Running on Ubuntu 14.04 Server. So I have fail2ban correctly configured to process /var/log/auth.log for SSH login attempts. Upon 3 failed attempts I see this in the fail2ban log: 2014-11-19 15:...
Halsafar's user avatar
  • 271
12 votes
1 answer
12k views

Fail2Ban blocking behaviours depending on the status code

I am using Fail2Ban and I have configured it as needed. This is reading logs from nginx/error.log and is acting depending on configs about maxretry and timing sets. The question is that is this ...
Parsa Samet's user avatar
10 votes
2 answers
25k views

Custom fail2ban Filter for phpMyadmin bruteforce attempts

In my quest to block excessive failed phpMyAdmin login attempts with fail2ban, I've created a script that logs said failed attempts to a file: /var/log/phpmyadmin_auth.log Custom log The format of ...
Michael Robinson's user avatar
4 votes
4 answers
7k views

Fail2Ban on CentOS 6.5 Never Bans

Environment: *CentOS 6.5 *Fail2Ban 0.8.14-1 *date outputs the correct date Behavior: Fail2ban starts successfully, but does not create iptables blocks after bad SSH login attempts. I'm only concerned ...
SteadH's user avatar
  • 676
2 votes
1 answer
2k views

iptables: REJECT not working, but DROP does

I have recently setup a server with fail2ban, and it is mostly working except I am getting errors whenever this command tries to execute: sudo iptables -D fail2ban-ssh -s xxx.xxx.xxx.xxx -j REJECT --...
Stephen's user avatar
  • 143
2 votes
1 answer
553 views

Fail2ban partial IP match possible?

My server (Ubuntu 18.04) is getting a lot of spam requests on Postfix. Fail2ban is working but the spammers keep changing the last part of IP and not getting banned. For example, 2021-10-09 09:40:01,...
Whip's user avatar
  • 260
121 votes
15 answers
533k views

How to show all banned IP with fail2ban?

When I run this command fail2ban-client status sshd I got this: Status for the jail: sshd |- Filter | |- Currently failed: 1 | |- Total failed: 81 | `- File list: /var/log/auth.log `- ...
Dark Cyber's user avatar
  • 1,319
65 votes
11 answers
65k views

Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

I'm setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I've seen many recommendations for both denyhosts and fail2ban, but few comparisons of the two....
spiffytech's user avatar
  • 1,093
48 votes
6 answers
87k views

Permanent block of IP after n retries using fail2ban

I have a fail2ban configured like below: block the ip after 3 failed attempts release the IP after 300 sec timeout This works perfectly and I want to keep it this way such that a valid user gets a ...
BTR Naidu's user avatar
  • 627
13 votes
2 answers
33k views

Fail2Ban unblock ipaddress

I am trying to unblock an IP address without restarting Fail2Ban each time, what is the best way of doing this? Or can you point me in the direction of a useful guide? As you can see below the IP ...
John Magnolia's user avatar
12 votes
5 answers
7k views

is fail2ban safe? Better to use ssh keys?

I'm in doubt if I should use key authentication when logging into SSH, or just go for fail2ban + ssh (root login disabled). Is fail2ban safe or is it really better to just go ahead and generate keys ...
solsol's user avatar
  • 1,131
12 votes
3 answers
24k views

Why is iptables not blocking an ip address?

I have configured fail2ban to monitor a certain pattern of malicious traffic I'm getting and ban IP addresses associated. Everything seems to be working great -- the regex is matching the pattern ...
jsdalton's user avatar
  • 223
12 votes
3 answers
12k views

How to block IPs that cause excessive 404 errors with Fail2ban?

I have installed Fail2Ban v0.10.2 on Ubuntu 18.04 with Apache 2.4.29 and enabled the standard ssh and apache jails for basic protection with email notification warnings, when an IP is blocked. Having ...
user avatar
9 votes
1 answer
9k views

Why is fail2ban finding but not banning

I noticed something strange on my Ubuntu Xenial server. It has SSH on the default port and it has fail2ban. Fail2ban is detecting brute force attempts on the server and are logged accordingly: 2017-...
Waleed Hamra's user avatar
9 votes
3 answers
7k views

fail2ban blocks IP in ignoreip list

I'm using fail2ban and it continues to block an IP even after I have whitelisted that IP. In /etc/fail2ban/jail.conf there is a line like the following one: ignoreip = 53.45.114.103 However fail2ban ...
bearrito's user avatar
  • 380
7 votes
1 answer
3k views

measures to take against a dns amplification attack

I recently discovered that my server was being used as part of a DNS DDOS. Basically, my BIND setup allowed recursion, and it was used to attack a certain IP address using IP spoofing. I took the ...
Waleed Hamra's user avatar
6 votes
6 answers
5k views

fail2ban and denyhosts constantly ban me on Ubuntu

I just got an Ubuntu instance on Linode. To secure the SSH on it, I installed fail2ban (using apt-get), but then had a problem: fail2ban kept banning my IP (for limited durations, thankfully) even ...
Trey Parkman's user avatar
5 votes
3 answers
12k views

How to ban Syn Flood Attacks using Fail2Ban?

In my log, I am frequently seeing dropped ips like this: > Oct 30 17:32:24 IPTables Dropped: IN=eth0 OUT= > MAC=04:01:2b:bd:b0:01:4c:96:14:ff:df:f0:08:00 SRC=62.210.94.116 > DST=128.199.xxx....
Neel's user avatar
  • 1,471
5 votes
3 answers
9k views

Have fail2ban send notification to banned party

I have fail2ban configured on some CentOS 5 and 6 servers, and it sends me an email with a whois of the IP whenever an IP is banned. Is it possible to configure fail2ban to also send a notification ...
Banjer's user avatar
  • 4,014
5 votes
4 answers
3k views

fail2ban bans me after a series of *successful* logins

I created a passwordless ssh login for one of my servers by using the authorized_keys file. The server has fail2ban on it, and I noticed that after several successful logins I could no longer log in (...
Tom's user avatar
  • 3,233
3 votes
4 answers
1k views

Protect ssh server

I've got a debian-machine running several services, like apache with http and https, jabber and an openssh server for administration. The ssh-server is not running on port 22. It's on something like ...
jss's user avatar
  • 31
3 votes
4 answers
7k views

Fail2ban does not ban any ip-adresses with vsftpd

Fail2ban starts okey. It work with my sshd filter and bans IP-adresses as it should. But with vsftpd it does not register failed logins when I run: fail2ban-client status vsftpd I have tried both ...
user251959's user avatar
3 votes
1 answer
776 views

fail2ban not banning on Ubuntu 19.04

I configured a jail for a PHP application login page, but failed login attempts: stephane@example:~$ tail -400f /home/stephane/dev/docker/projects/common/volumes/logs/php_error_log [15-Oct-2019 12:15:...
Stephane's user avatar
  • 227
3 votes
1 answer
1k views

Can fail2ban detect and block IP-ranges?

Every day I get hundreds of this lines in my mail.log: Apr 28 11:10:28 servername amavis[30077]: (30077-08) Blocked SPAM {DiscardedInbound,Quarantined}, [185.140.110.16] <[email protected]> -> <...
Hubert Schölnast's user avatar
3 votes
1 answer
1k views

I'm trying to catch brute force against /xmlrpc.php with fail2ban

I'm getting a ton of failed a ton of failed access: 185.103.252.174 - - [28/Apr/2016:15:09:16 -0400] "POST /xmlrpc.php HTTP/1.1" 499 0 "-" "Googlebot/2.1 (+http://www.google.com/bot.html)" 173.246.56....
Kit Sunde's user avatar
  • 946
3 votes
2 answers
16k views

How to set up fail2ban with UFW on Ubuntu 20.04?

I'm trying to block IP addresses with fail2ban and ufw with the following configuration and the default ufw.conf in /etc/fail2ban/action.d. Jail config [app-custom] enabled = true maxretry = 1 ...
Yohan W. Dunon's user avatar
2 votes
1 answer
2k views

Fail2ban filter for error 400 on nginx

I have a nginx server I am hosting very base php website (school club) and log file show lot of weird requests how do I block them. I tried using fail2ban but my filters were not accurate. nginx-400....
Aron's user avatar
  • 21
2 votes
1 answer
2k views

Fail2Ban Not Banning on CentOS 7 with SELinux

On a LEMP stack with WordPress and the WP fail2ban plugin, WordPress authentication issues get logged to /var/log/messages perfectly fine. $ sudo fail2ban-client version 0.9.2 In the last couple of ...
JayMcTee's user avatar
  • 4,021
2 votes
3 answers
2k views

Fail2ban unban action fails with Cloudflare

I'm trying to setup Cloudflare blocking with fail2ban using this guide and while it bans the IP correctly, fail2ban cannot unban the IP from Cloudflare either after timeout or with manual shell ...
Vinit Wankhede's user avatar
2 votes
1 answer
1k views

fail2ban appends to chain after installing iptables-persistent

I've used fail2ban a while now. Today I wanted to learn more about iptables and found iptables-persistent. After installing, saving and cleanup the iptables rules in /etc/iptables/rules.v4 it looks ...
Someone's user avatar
  • 21
2 votes
3 answers
9k views

Why isn't fail2ban blocking failures?

This below is the output of fail2ban log. Nothing more shows up, but in auth.log I see like hundreds of failures for root user login (someone is bad ass brute forcing). 2011-07-06 01:48:16,249 ...
Rihards's user avatar
  • 779
2 votes
1 answer
15k views

How To use fail2ban for Nginx? [closed]

How can I use fail2ban on an Nginx server? What are the rules to put in the jails.conf?
THpubs's user avatar
  • 1,775
1 vote
1 answer
4k views

Why isn't Fail2ban regenerating its iptables chains?

At some point while running iptables -S on an Ubuntu 18.04.2 LTS system with Fail2ban installed, I noticed that the following lines were missing: -N f2b-sshd -A f2b-sshd -j RETURN What command ...
Chris Frederick's user avatar
1 vote
1 answer
812 views

Cloudflare behind site iptables not blocking HTTP and HTTPS ports

When the Fail2ban trigger an IP ban action, I want to block all the ports on my Ubuntu Server. Right now, I use banaction = iptables-allports and CSF. At this moment it only blocked SSH port, even if ...
Chathu's user avatar
  • 107
1 vote
1 answer
2k views

Fail2Ban keeps banning on restart

I'm facing a confusing issue with Fail2Ban. I run an older version which, upon restart of the Fail2Ban Daemon unbans all IP addresses. I now have Fail2Ban version 0.9.3 installed on Centos 7. When I ...
MrCarrot's user avatar
  • 355
1 vote
1 answer
1k views

fail2ban: unban behavior when two jails ban the same IP?

I have two fail2ban jails that deal with postfix: one called postfixsasl and one called postfixauth. They each are looking for different regex matches for triggering bans. It is possible that both of ...
HippoMan's user avatar
  • 230
1 vote
1 answer
182 views

Fail2Ban - Match Asterisk PJSIP Successful Authentication

I'm trying to create a fail2ban filter that will match successful authentications. An example log entry looks like this: [2023-05-25 18:41:00] VERBOSE[26149] res_pjsip/pjsip_options.c: Contact user/...
Nick Coons's user avatar
1 vote
2 answers
2k views

can fail2ban add deny rules to nginx instead of using iptables

I'm having one server, that is behind a reverse proxy, that I don't control. I'd like to use fail2ban to block nginx traffic under certain conditions. normally fail2ban useses iptables to block ...
gelonida's user avatar
  • 279
1 vote
2 answers
2k views

Fail2ban configuration for nginx using firewallcmd in CentOS 7

Previously I have a CentOS 6.5 with Iptables and I configure some jails for nginx as suggested here: How To use fail2ban for Nginx?. But now I am in CentOS 7, trying to use the new firewall and ...
Mariano Martinez Peck's user avatar
0 votes
1 answer
432 views

Blocking tor traffic with postfix or fail2ban on mailserver

I am running an Ubuntu 20.04 Lemp server, with postfix/dovecot. I have fail2ban set up so that if 2 unsuccessful loging attempts to my email are made by the same ip address, fail2ban bans the ip's ...
DanRan's user avatar
  • 123
0 votes
1 answer
2k views

fail2ban on Raspbian does not create iptables jails

I installed fail2ban 0.10.2-2.1 on Raspbian Buster to protect ssh (and if that works, apache). The default installation only enables de sshd jail, but in my case that does not seem to work. The ...
Rolf's user avatar
  • 151
0 votes
1 answer
1k views

Block Remote Code Execution Ubuntu Server Fail2Ban & Cloudflare

Recently I figured out, that my Ubuntu (LEMP) server became a target for remote code execution attacks. In terms of access.log files it could looks like: 183.82.248.85 - - [06/Mar/2019:19:12:21 +...
Chathu's user avatar
  • 107
0 votes
3 answers
2k views

UFW + fail2ban not working with `nginx` to block attack scripts

my server is currently attacked by some script kiddies. I have set up fail2ban which correctly bans the IP. 2020-01-07 05:51:45,639 fail2ban.actions [1656]: WARNING [nginx-botsearch] 123.207....
Powerriegel's user avatar
0 votes
2 answers
2k views

Blocking all malicious nginx connections with fail2ban

Recently there was a big increase in attacks on my server which made me switch to a more aggressive fail2ban blocking policy. In attempt to reduce the number of incoming connections I also ...
Kaemmelot's user avatar
0 votes
1 answer
5k views

Fail2Ban - Iptables - Set does not exist

I have a very strange problem with fail2ban/iptables. Something is not working right, but I can't figoure out what. I have added this conf & and filter for fail2ban: [wordpress-register] enabled ...
TheNiceGuy's user avatar