Questions tagged [fail2ban]
Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address.
724
questions
6
votes
2
answers
3k
views
Should i use Firewalld or Iptables for Fail2ban in Centos 7?
I'm setting up Fail2ban to protect ssh, and I use firewalld,
I saw a lot of people recommending to use anaction = iptables-multiport
and other solutions using iptables instead of firewalld claiming ...
- 177
1
vote
1
answer
7k
views
Unable to reinstall fail2ban after completly removing it from Centos 7
After completely removing Fail2ban from Centos 7, I decided to reinstall it.
So I run the installation(yum), and everything seems ok, no errors, But the it seems like the installation does not create ...
- 177
0
votes
0
answers
1k
views
fail2ban doesnt read log if file being used
My environment is Ubuntu 14.04, LAMP stack all from apt.
implemented fail2ban and configured jail.local with
backend = auto
[ssh]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
...
- 101
4
votes
0
answers
1k
views
Fail2ban floods and slow response time
I tried searching for this; I found many people asking but I wasn't successfully to find a working (for me) solution.
I have an application that logs each connection on a custom log file.
When ...
0
votes
0
answers
1k
views
Issue with Fail2ban and Mikrotik Firewall
OS: CentOS 7.1
At my organization we are currently assessing using Fail2ban with the firewall on our Mikrotik router. I want Fail2ban to communicate any IP flagged as banned to the Mikrotik firewall,...
- 9
2
votes
2
answers
825
views
Fail2Ban regex is wrong?
I'm currently setting up a filter to filter POST attacks on a file named xmlrpc.php. Requests that should be monitored in the log access look like:
1.99.437.201 - - [01/Feb/2016:01:57:14 +0000] "POST ...
- 153
0
votes
0
answers
381
views
Nagios check_log reset to OK after notification
Fail2ban is installed on one of the servers, I'm able to ban every IP that try to log in.
I'm using the check_log plugin of Nagios to capture the last line of the fail2ban.log, it compares to the ...
- 287
9
votes
2
answers
42k
views
How to check if firewalld is blocking an incoming ip address?
I have CentOS 7 with firewalld. I installed fail2ban and using the firewallcmd-new action. I am seeing bans in the fail2ban logs, and I want to check in firewallcmd if they are blocked. How can I do ...
- 1,877
0
votes
1
answer
2k
views
why fail2ban does not ban? (ubuntu, ssh)
I installed a fresh Ubuntu machine. Then I changed the ssh port which is no more 22 but 22111:
Then I have installed fail2ban:
apt-get install fail2ban -y
cp /etc/fail2ban/jail.conf /etc/fail2ban/...
- 3
1
vote
1
answer
421
views
CentOS server blocking own outgoing traffic
I've got a server (CentOS 6.7) running, which causes me some headaches.
A few months ago, the website running on the server was unavailable. After some digging, it appeared that Iptables was blocking ...
- 121
4
votes
2
answers
5k
views
How do I specify multiple logfiles for a jail in fail2ban?
Heyo,
I'm using Ubuntu 15.10 and fail2ban 0.9.3. Apache is set up with a bunch of Apache virtualhosts.
I have my Apache2 logfiles located in subdirectories, one per localhost, e.g. '/var/log/apache2/...
- 51
-1
votes
2
answers
2k
views
How can I reject spam before reaching SMTP on Postfix
My server has started receiving thousands of attempts to use my mail server to send spam from dynamic.hinet.net. The attempts are always rejected, but it's non-stop. I'd like to block these attempts ...
- 109
1
vote
2
answers
3k
views
Configure Fail2ban for SSH and ldap
I have a fail2ban Installation on two Centos7 machines, and I want to secure SSH with it (The SSH protecting seems active), set the allowed pw-fails to 5, and left the banntime at 3600 secs. I tried ...
- 93
0
votes
1
answer
91
views
Fail2ban with Hipchat server
Has anyone managed to get fail2ban working with hipchat server?
I've found the log file and here's an example of a failure;
Authentication for '[email protected]' failed. HTTP code: 403, XMPP error: ...
9
votes
3
answers
7k
views
fail2ban blocks IP in ignoreip list
I'm using fail2ban and it continues to block an IP even after I have whitelisted that IP.
In /etc/fail2ban/jail.conf there is a line like the following one:
ignoreip = 53.45.114.103
However fail2ban ...
- 380
5
votes
1
answer
6k
views
How to detect SMTP AUTH attempts in Fail2Ban?
I have a Fail2Ban jail that monitors failed SASL authentications to my Postfix SMTP server. When this occurs, /var/log/mail.log contains these three lines:
postfix/smtpd[32591]: connect from unknown[...
- 336
1
vote
1
answer
1k
views
Fail2Ban regex to match these lines?
I've been trying to get fail2ban to work with the Xeams email spam filter. But, I can't figure out what possible regex I should use to match the logs. The logs are in this format.
61.240.144.65 ...
- 403
3
votes
1
answer
5k
views
Fail2Ban not banning IPs with different ports
I am getting different SSH attacks from the same IPs and they are getting banned. But they are using a different port and all they have to do is change the port to bypass the ban.
Dec 28 23:16:57 ...
- 35
2
votes
2
answers
4k
views
How to mitigate DDOS attacks on AWS?
I have web application (NodeJS) and I plan to deploy it to AWS. To minimize the cost it will run on single EC2 instance. I'm worried though about what will happen if someone decides to bless me with ...
- 197
0
votes
0
answers
104
views
Cannot get fail2ban failregex to match log
This is the failregex
^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",...
- 698
0
votes
2
answers
592
views
Fail2ban not banning after update to latest version
I was running fail2ban 0.8.11 which is the version installed on Ubuntu 14.04 with apt-get. I downloaded and installed the latest source, 0.93.
When I start it up, I get two error messages.
WARNING ...
- 101
1
vote
1
answer
232
views
Is fail2ban not matching these lines just because of the port?
I would like fail2ban to engage against these lines and block the example IP address included:
[Tue Dec 08 12:17:13.622175 2015] [:error] [pid 30390] [client 62.210.88.201:38139] script '/var/www/...
- 15
0
votes
1
answer
1k
views
Is fail2ban necessary? [closed]
I have disabled the root login, disabled the password authentication option, and blocked all ports except 22 and 80 for a linux virtual server I run.
The only way to access the server is with a 4096 ...
- 21
1
vote
0
answers
691
views
How do I set Host Groups on Fail2ban for Wordpress?
I'm trying to set up a custom filter for fail2ban on a wordpress site. I've been following this tutorial but when I try to test my custom filter, I get the error: server.failregex.RegexException: No '...
- 11
2
votes
1
answer
421
views
fail2ban rules not coming into effect
I have installed the Apache web server on a stock installation of Ubuntu 14.04, and I am trying to use fail2ban to block requests that check for vulnerabilities.
I have put the following in /etc/...
user175627
3
votes
1
answer
752
views
fail2ban BANTIME not working for SASL
My fail2ban bantime does not appear to be working. I still get repeated ban notifications from the same IP within 45 minutes of each other. My bantime is set to 24 hours.
[sasl]
enabled = true
port ...
- 605
-1
votes
1
answer
323
views
Can I use the following Fail2ban jail with my wordpress on nginx server?
[nginx-noscript]
enabled = true
port = http,https
filter = nginx-noscript
logpath = /var/log/nginx/access.log
maxretry = 6
It is advised to not enable [nginx-noscript] jail, if server is ...
- 21
1
vote
1
answer
2k
views
fail2ban for apache access log
I have tried all the approaches I know of to get the host from the apache access log but none have worked
my basic testing approach is as follows:
fail2ban-regex '87.97.244.57 - - [05/Nov/2015:12:46:...
- 40
3
votes
0
answers
686
views
Fail2Ban emails not showing extracts from Apache logfiles
I have recently set up Debian Jessie on a server for the first time. 'Obviously' fail2ban was set up very early in the process.
It is banning IP addresses and sending me emails ok, but the Apache-...
- 31
1
vote
0
answers
30
views
Anomalous iptables entry with fail2ban (is it misconfigured to block outward traffic?)
Overall we are very satisfied with fail2ban as it has accumulated several dozen neverdowell IP addresses in our iptables rules.
However I notice the following rule has also appeared:
Chain fail2ban-...
- 492
1
vote
1
answer
2k
views
Fail2Ban plug-in is enabled in Munin but the graph images are broken. How to fix?
I recently installed Fail2Ban on an Ubuntu 12.04.5 server and it’s working great. Now I want to setup Munin so it can monitor it and generate graphs/reports. I found that Munin has a built-in Fail2Ban ...
- 3,571
2
votes
2
answers
4k
views
How can I upgrade Fail2Ban in Ubuntu 12.04.5 LTS to get the “recidive” filter installed?
Basic question.
How can I install an upgraded version of Fail2Ban on my Ubuntu 12.04.5 LTS (Precise Pangolin) so I can have a recidive filter set. Ubuntu 12.04.5 LTS installs Fail2Ban 0.8.6 and I ...
- 3,571
0
votes
1
answer
284
views
Determining e-mail server blacklisting from log files
I have my self-hosted e-mail server. There is no current problem of being blacklisted but I want to be proactive about it and I want to start with the log files.
There have been some entries in my ...
- 1
1
vote
1
answer
409
views
What are the differences between Fail2Ban and BFD (Brute Force Detection)
I have used both Fail2Ban and BFD, typically I go with Fail2Ban on servers running IPTables, and BFD when servers are running APF.
Are there any major differences between these 2 services? What are ...
- 8,006
4
votes
2
answers
4k
views
fail2ban.action ERROR iptables -w -N f2b-<jail-name>
I've been using fail2ban for a while without any issues.
The other day, I decided to stop fail2ban to remove one rule from my default iptables. When I started fail2ban, it started ok (according to ...
- 231
0
votes
1
answer
2k
views
Change the order that an IPTABLE CHAIN is read (Using Fail2Ban)
I have some experience using iptables and fail2ban.
Both are working as they should, but I would like to optimize the way packets are "DROPed" when IP & port probing occur.
Fail2Ban is doing a ...
3
votes
1
answer
5k
views
Fail2ban: regex test succeed but fail2ban does not ban any IP
I can't ban any ip, thought when I test my regex, it has +2000matches:
> fail2ban-regex '/var/log/nginx/access.log' '/etc/fail2ban/filter.d/bad-request.conf'
Date template hits:
|- [# of hits] ...
- 133
3
votes
1
answer
3k
views
fail2ban regex filter doesnt work with nginx log files
I have been banging my head all day trying to match my regex filter to my access.log with no luck. I have installed fail2ban on a gentoo server and its running fine (i manually baned my own IP and it ...
user314215
2
votes
1
answer
1k
views
SELinux preventing Fail2Ban from emailing notification via msmtp
I have msmtp as a null client connecting to my AWS SES account for SMTP, delivering alerts such as cron, monit and soon hopefully Fail2Ban to my email addresses. However, Fail2Ban isn't playing ball, ...
- 4,021
1
vote
0
answers
857
views
Fail2Ban regex in sshd.conf not catching failed root logins in /var/log/auth.log
I used Fail2Ban on my Ubuntu server (14.04 LTS), and it mostly works well.
I recently noticed the default regex in /etc/fail2ban/filter.d/sshd.conf does not match some failed sshd login attempts.
...
- 165
0
votes
1
answer
278
views
Fail2ban fail to start with several error messages
I've installed fail2ban for my CentOS 6, but when it starts, I get the error message
Failed to start server : Starting fail2ban: WARNING 'ignoreregex'
not defined in 'Definition'. Using default one: ...
- 398
1
vote
1
answer
140
views
fail2ban blocks ip twice for some reason
I have a file of blacklisted IPs that get loaded through fail2ban into iptables when fail2ban starts up.
Assuming the initial list looks like this at startup:
Chain fail2ban-ip-blacklist (1 ...
- 113
3
votes
1
answer
3k
views
fail2ban multiple logpath directive
I've created my own custom filter, action etc for fail2ban.
Just have a question about the logpath.
logpath = /path/to/my/file1.log
/path/to/my/file2.log
/path/to/my/file3....
- 131
0
votes
1
answer
498
views
CentOS 6 fail2ban fails to ban http dos requests
Fail2ban fails to ban clients that make an excessive amount of requests over HTTP. SSH bans do work fine
To test this I have made several tests using ab and curl from other servers. I even made sure ...
- 257
1
vote
2
answers
2k
views
High inbound and outbound network traffic
Over the last day or so, one of instances has had a large amount of bandwidth consumed. This means that we have nearly exceeded our allowance (roughly the same amount inbound and outbound).
Looking ...
- 153
0
votes
1
answer
1k
views
How to ban a ip with fail2ban using fail2ban-client and actionban
I am on fail2ban 0.8.3 and I would like to ban an ip address after reloading fail2ban.
I tried:
fail2ban-client get myjail actionban ip
after that I get an empty line in bash and fail2ban status ...
- 2,984
2
votes
1
answer
2k
views
Fail2Ban Not Banning on CentOS 7 with SELinux
On a LEMP stack with WordPress and the WP fail2ban plugin, WordPress authentication issues get logged to /var/log/messages perfectly fine.
$ sudo fail2ban-client version
0.9.2
In the last couple of ...
- 4,021
2
votes
1
answer
4k
views
How to change mail "from" name for Fail2Ban email notifications?
I have Fail2Ban sending me emails from various servers but I can't tell at a glance which server because the email "from" name is always just "Fail2Ban".
I've managed to set the "from" address ...
- 121
1
vote
1
answer
901
views
fail2ban not mailing on Arch
I have 3 servers, 2 Debian and 1 Arch. As usual the Arch makes me work hard for the simple things. This time it's fail2ban.
My installation of fail2ban is default, its version 0.9.3-3.
To test if my ...
- 125
2
votes
1
answer
4k
views
why is are there dns host names in my iptables entries? (fail2ban)
I recently installed fail2ban which has begun blocking bad ssh attempts.
I also set up an additional filter to permanently ban repeat offenders.
I notice now that there are some entries in my ...
- 627