Questions tagged [fail2ban]
Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.
50
questions
14
votes
5
answers
8k
views
Is it worth the effort to block failed login attempts
Is it worthwhile running fail2ban, sshdfilter or similar tools, which blacklist IP addresses which attempt and fail to login?
I've seen it argued that this is security theatre on a "properly secured"...
304
votes
17
answers
735k
views
How to Unban an IP properly with Fail2Ban
I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly.
I know I can work with IPTables directly: iptables -D fail2ban-ssh <number>
But is there not a way to do it with ...
39
votes
5
answers
84k
views
In Fail2Ban, How to Change the SSH port number?
In my server, the ssh port is not the standard 22. I have set a different one. If I setup fail2ban, will it be able to detect that port? How can I tell it to check that port rather than port 22?
The ...
33
votes
1
answer
38k
views
How to set up fail2ban to read multi log in a jail?
How can I configure multiple logpaths for the same rule?
I'm trying to write a syntax like this:
[apache-w00tw00t]
enabled = true
filter = apache-w00tw00t
action = iptables-allports
logpath = /...
15
votes
3
answers
28k
views
How do I setup monitoring of MySQL with Fail2ban?
Searching the internet with search engines on MySQL and fail2ban yields lots of results on putting your fail2ban logs into MySQL, however I'm wanting to monitor failed MySQL attempts to log in and ban ...
15
votes
3
answers
12k
views
Fail2Ban Correctly Attempts to Ban IP but IP does not get banned - iptables chain exists but not working
Running on Ubuntu 14.04 Server.
So I have fail2ban correctly configured to process /var/log/auth.log for SSH login attempts.
Upon 3 failed attempts I see this in the fail2ban log:
2014-11-19 15:...
12
votes
1
answer
12k
views
Fail2Ban blocking behaviours depending on the status code
I am using Fail2Ban and I have configured it as needed. This is reading logs from nginx/error.log and is acting depending on configs about maxretry and timing sets. The question is that is this ...
10
votes
2
answers
25k
views
Custom fail2ban Filter for phpMyadmin bruteforce attempts
In my quest to block excessive failed phpMyAdmin login attempts with fail2ban, I've created a script that logs said failed attempts to a file: /var/log/phpmyadmin_auth.log
Custom log
The format of ...
4
votes
4
answers
7k
views
Fail2Ban on CentOS 6.5 Never Bans
Environment:
*CentOS 6.5
*Fail2Ban 0.8.14-1
*date outputs the correct date
Behavior:
Fail2ban starts successfully, but does not create iptables blocks after bad SSH login attempts. I'm only concerned ...
2
votes
1
answer
2k
views
iptables: REJECT not working, but DROP does
I have recently setup a server with fail2ban, and it is mostly working except I am getting errors whenever this command tries to execute:
sudo iptables -D fail2ban-ssh -s xxx.xxx.xxx.xxx -j REJECT --...
2
votes
1
answer
553
views
Fail2ban partial IP match possible?
My server (Ubuntu 18.04) is getting a lot of spam requests on Postfix. Fail2ban is working but the spammers keep changing the last part of IP and not getting banned. For example,
2021-10-09 09:40:01,...
121
votes
15
answers
533k
views
How to show all banned IP with fail2ban?
When I run this command fail2ban-client status sshd I got this:
Status for the jail: sshd
|- Filter
| |- Currently failed: 1
| |- Total failed: 81
| `- File list: /var/log/auth.log
`- ...
65
votes
11
answers
65k
views
Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?
I'm setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I've seen many recommendations for both denyhosts and fail2ban, but few comparisons of the two....
48
votes
6
answers
87k
views
Permanent block of IP after n retries using fail2ban
I have a fail2ban configured like below:
block the ip after 3 failed attempts
release the IP after 300 sec timeout
This works perfectly and I want to keep it this way such that a valid user gets a ...
13
votes
2
answers
33k
views
Fail2Ban unblock ipaddress
I am trying to unblock an IP address without restarting Fail2Ban each time, what is the best way of doing this? Or can you point me in the direction of a useful guide?
As you can see below the IP ...
12
votes
5
answers
7k
views
is fail2ban safe? Better to use ssh keys?
I'm in doubt if I should use key authentication when logging into SSH, or just go for fail2ban + ssh (root login disabled).
Is fail2ban safe or is it really better to just go ahead and generate keys ...
12
votes
3
answers
24k
views
Why is iptables not blocking an ip address?
I have configured fail2ban to monitor a certain pattern of malicious traffic I'm getting and ban IP addresses associated.
Everything seems to be working great -- the regex is matching the pattern ...
12
votes
3
answers
12k
views
How to block IPs that cause excessive 404 errors with Fail2ban?
I have installed Fail2Ban v0.10.2 on Ubuntu 18.04 with Apache 2.4.29 and enabled the standard ssh and apache jails for basic protection with email notification warnings, when an IP is blocked.
Having ...
9
votes
1
answer
9k
views
Why is fail2ban finding but not banning
I noticed something strange on my Ubuntu Xenial server.
It has SSH on the default port and it has fail2ban.
Fail2ban is detecting brute force attempts on the server and are logged accordingly:
2017-...
9
votes
3
answers
7k
views
fail2ban blocks IP in ignoreip list
I'm using fail2ban and it continues to block an IP even after I have whitelisted that IP.
In /etc/fail2ban/jail.conf there is a line like the following one:
ignoreip = 53.45.114.103
However fail2ban ...
7
votes
1
answer
3k
views
measures to take against a dns amplification attack
I recently discovered that my server was being used as part of a DNS DDOS. Basically, my BIND setup allowed recursion, and it was used to attack a certain IP address using IP spoofing.
I took the ...
6
votes
6
answers
5k
views
fail2ban and denyhosts constantly ban me on Ubuntu
I just got an Ubuntu instance on Linode. To secure the SSH on it, I installed fail2ban (using apt-get), but then had a problem: fail2ban kept banning my IP (for limited durations, thankfully) even ...
5
votes
3
answers
12k
views
How to ban Syn Flood Attacks using Fail2Ban?
In my log, I am frequently seeing dropped ips like this:
> Oct 30 17:32:24 IPTables Dropped: IN=eth0 OUT=
> MAC=04:01:2b:bd:b0:01:4c:96:14:ff:df:f0:08:00 SRC=62.210.94.116
> DST=128.199.xxx....
5
votes
3
answers
9k
views
Have fail2ban send notification to banned party
I have fail2ban configured on some CentOS 5 and 6 servers, and it sends me an email with a whois of the IP whenever an IP is banned. Is it possible to configure fail2ban to also send a notification ...
5
votes
4
answers
3k
views
fail2ban bans me after a series of *successful* logins
I created a passwordless ssh login for one of my servers by using the authorized_keys file.
The server has fail2ban on it, and I noticed that after several successful logins I could no longer log in (...
3
votes
4
answers
1k
views
Protect ssh server
I've got a debian-machine running several services, like apache with http and https, jabber and an openssh server for administration. The ssh-server is not running on port 22. It's on something like ...
3
votes
4
answers
7k
views
Fail2ban does not ban any ip-adresses with vsftpd
Fail2ban starts okey. It work with my sshd filter and bans IP-adresses as it should. But with vsftpd it does not register failed logins when I run:
fail2ban-client status vsftpd
I have tried both ...
3
votes
1
answer
776
views
fail2ban not banning on Ubuntu 19.04
I configured a jail for a PHP application login page, but failed login attempts:
stephane@example:~$ tail -400f /home/stephane/dev/docker/projects/common/volumes/logs/php_error_log
[15-Oct-2019 12:15:...
3
votes
1
answer
1k
views
Can fail2ban detect and block IP-ranges?
Every day I get hundreds of this lines in my mail.log:
Apr 28 11:10:28 servername amavis[30077]: (30077-08) Blocked SPAM {DiscardedInbound,Quarantined}, [185.140.110.16] <[email protected]> -> <...
3
votes
1
answer
1k
views
I'm trying to catch brute force against /xmlrpc.php with fail2ban
I'm getting a ton of failed a ton of failed access:
185.103.252.174 - - [28/Apr/2016:15:09:16 -0400] "POST /xmlrpc.php HTTP/1.1" 499 0 "-" "Googlebot/2.1 (+http://www.google.com/bot.html)"
173.246.56....
3
votes
2
answers
16k
views
How to set up fail2ban with UFW on Ubuntu 20.04?
I'm trying to block IP addresses with fail2ban and ufw with the following configuration and the default ufw.conf in /etc/fail2ban/action.d.
Jail config
[app-custom]
enabled = true
maxretry = 1
...
2
votes
1
answer
2k
views
Fail2ban filter for error 400 on nginx
I have a nginx server I am hosting very base php website (school club) and log file show lot of weird requests how do I block them. I tried using fail2ban but my filters were not accurate.
nginx-400....
2
votes
1
answer
2k
views
Fail2Ban Not Banning on CentOS 7 with SELinux
On a LEMP stack with WordPress and the WP fail2ban plugin, WordPress authentication issues get logged to /var/log/messages perfectly fine.
$ sudo fail2ban-client version
0.9.2
In the last couple of ...
2
votes
3
answers
2k
views
Fail2ban unban action fails with Cloudflare
I'm trying to setup Cloudflare blocking with fail2ban using this guide and while it bans the IP correctly, fail2ban cannot unban the IP from Cloudflare either after timeout or with manual shell ...
2
votes
1
answer
1k
views
fail2ban appends to chain after installing iptables-persistent
I've used fail2ban a while now. Today I wanted to learn more about iptables and found iptables-persistent.
After installing, saving and cleanup the iptables rules in /etc/iptables/rules.v4 it looks ...
2
votes
3
answers
9k
views
Why isn't fail2ban blocking failures?
This below is the output of fail2ban log. Nothing more shows up, but in auth.log I see like hundreds of failures for root user login (someone is bad ass brute forcing).
2011-07-06 01:48:16,249 ...
2
votes
1
answer
15k
views
How To use fail2ban for Nginx? [closed]
How can I use fail2ban on an Nginx server? What are the rules to put in the jails.conf?
1
vote
1
answer
4k
views
Why isn't Fail2ban regenerating its iptables chains?
At some point while running iptables -S on an Ubuntu 18.04.2 LTS system with Fail2ban installed, I noticed that the following lines were missing:
-N f2b-sshd
-A f2b-sshd -j RETURN
What command ...
1
vote
1
answer
812
views
Cloudflare behind site iptables not blocking HTTP and HTTPS ports
When the Fail2ban trigger an IP ban action, I want to block all the ports on my Ubuntu Server. Right now, I use banaction = iptables-allports and CSF. At this moment it only blocked SSH port, even if ...
1
vote
1
answer
2k
views
Fail2Ban keeps banning on restart
I'm facing a confusing issue with Fail2Ban.
I run an older version which, upon restart of the Fail2Ban Daemon unbans all IP addresses.
I now have Fail2Ban version 0.9.3 installed on Centos 7. When I ...
1
vote
1
answer
1k
views
fail2ban: unban behavior when two jails ban the same IP?
I have two fail2ban jails that deal with postfix: one called postfixsasl and one called postfixauth. They each are looking for different regex matches for triggering bans. It is possible that both of ...
1
vote
1
answer
182
views
Fail2Ban - Match Asterisk PJSIP Successful Authentication
I'm trying to create a fail2ban filter that will match successful authentications. An example log entry looks like this:
[2023-05-25 18:41:00] VERBOSE[26149] res_pjsip/pjsip_options.c: Contact user/...
1
vote
2
answers
2k
views
can fail2ban add deny rules to nginx instead of using iptables
I'm having one server, that is behind a reverse proxy, that I don't control.
I'd like to use fail2ban to block nginx traffic under certain conditions.
normally fail2ban useses iptables to block ...
1
vote
2
answers
2k
views
Fail2ban configuration for nginx using firewallcmd in CentOS 7
Previously I have a CentOS 6.5 with Iptables and I configure some jails for nginx as suggested here: How To use fail2ban for Nginx?.
But now I am in CentOS 7, trying to use the new firewall and ...
0
votes
1
answer
432
views
Blocking tor traffic with postfix or fail2ban on mailserver
I am running an Ubuntu 20.04 Lemp server, with postfix/dovecot. I have fail2ban set up so that if 2 unsuccessful loging attempts to my email are made by the same ip address, fail2ban bans the ip's ...
0
votes
1
answer
2k
views
fail2ban on Raspbian does not create iptables jails
I installed fail2ban 0.10.2-2.1 on Raspbian Buster to protect ssh (and if that works, apache). The default installation only enables de sshd jail, but in my case that does not seem to work. The ...
0
votes
1
answer
1k
views
Block Remote Code Execution Ubuntu Server Fail2Ban & Cloudflare
Recently I figured out, that my Ubuntu (LEMP) server became a target for remote code execution attacks. In terms of access.log files it could looks like:
183.82.248.85 - - [06/Mar/2019:19:12:21 +...
0
votes
3
answers
2k
views
UFW + fail2ban not working with `nginx` to block attack scripts
my server is currently attacked by some script kiddies. I have set up fail2ban which correctly bans the IP.
2020-01-07 05:51:45,639 fail2ban.actions [1656]: WARNING [nginx-botsearch] 123.207....
0
votes
2
answers
2k
views
Blocking all malicious nginx connections with fail2ban
Recently there was a big increase in attacks on my server which made me switch to a more aggressive fail2ban blocking policy.
In attempt to reduce the number of incoming connections I also ...
0
votes
1
answer
5k
views
Fail2Ban - Iptables - Set does not exist
I have a very strange problem with fail2ban/iptables. Something is not working right, but I can't figoure out what.
I have added this conf & and filter for fail2ban:
[wordpress-register]
enabled ...