New answers tagged

0

In the loglines you posted you can see the error " /bin/sh: 2: iptables: not found'" A command not found message usually means that either the command is not installed, or (less often) that the command is not within the PATH environment variable. Try to install the package which includes the required command, in your case this would be the iptables ...


1

All the products / tools you list have a different focus and target different threats/aspects of system security. One is not intrinsically better than the other. The use of one does also not exclude the usage of any of the others. You can use them in concert to create a limited form of defense in depth. The only thing missing from your list is arguably the ...


1

Your failregex is not accurate (moreover it is vulnerable) because it is searching and can find 400 literally everywhere and not as a response code only. The begin anchor (^) is only working for <HOST> tag and stops to operate hereafter due to catch-all .* and not end-anchored, because .*$ is not an anchor at all, so ultimately the regex is unanchored ...


0

If the issue is in fact a reverse proxy that you can't block the source IP of for fear of blocking legitimate traffic, then perhaps the reverse proxy you're using can block the IP, and you can use Fail2ban to block that address using an API (in some cases). One such case is Cloudflare, which already has Fail2ban actions for such a purpose, using firewall ...


2

From the man page for jail.conf: filter name of the filter -- filename of the filter in /etc/fail2ban/filter.d/ without the .conf/.local extension. Only one filter can be specified. Fail2ban is probably looking for a file named motion-auth.conf.conf. Your jail should be: [motion-auth] enabled = true port = 8008 filter = motion-auth ... If your filter ...


Top 50 recent answers are included