Questions tagged [fail2ban]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
14 views

IPtables chain number persistence - how could I keep 1st rule on top?

Summary I'm trying to understand how to keep a rule on top of a chain in IPtables. I'd like to keep my custom chain (as a rule) on top of the INPUT chain, that is, as the first rule in the chain. ...
0
votes
0answers
33 views

Fail2Ban and Docker Network Bridge - X-Real-IP

/etc/fail2ban/filter.d/caddy-4xx.conf [Definition] failregex = ^<HOST>.*"(GET|POST).*" (404|444|403|400) .*$ ignoreregex = /etc/fail2ban/jail.local [caddy-4xx] port = ...
0
votes
1answer
25 views

Ban across entire system based on ssh attempts

I have fail2ban set up to ban anyone who tries to connect via. ssh without my certificate. I currently have a list of 1886 banned addresses (and counting), majority of which originate from China. ...
0
votes
1answer
87 views

Create Fail2ban Rule for Named

As I am trying to create a rule for Fail2ban which seems to me missing for a long while as I being really nerved by in the past I'm also willing to submit it to the world :-) What's been done? ...
0
votes
0answers
17 views

Fail2Ban fails to Ban

So I have a server online and I am using Fail2Ban to ban IPs that are bruteforcing my server. I did some testing today, and it seems that isn't the case. Let's start from the beginning. > sudo ...
0
votes
1answer
147 views

How to make fail2ban use pyinotify on fresh ubuntu 20.04 install?

I just created a new Ubuntu 20.04 server. I installed Fail2Ban for ssh protection. I noticed in /var/log/fail2ban.log that the sshd jail starts with "poller" as the backend. I haven't ...
1
vote
1answer
727 views

Fail2ban - Failed during configuration: File contains no section headers

I'm working on setting up Fail2ban for my linux (debian) server. When I check the status of the fail2ban service I am getting this error: ● fail2ban.service - Fail2Ban Service Loaded: loaded (/lib/...
0
votes
1answer
73 views

Fail2ban bans not working

What exactly does a ban do? I know this kinda absurd to ask, but still. I know it ban login attempts. But does it prevent banned IPs from attempting succesful logins? I banned a test ip (both manually ...
0
votes
0answers
23 views

fail2ban error with ssh-ddos

I am trying to get fail2ban working with ssh. I have changed the ssh port to 900 and have the following in /etc/fail2ban/jail.local: [sshd] enabled = true port = 900 logpath = %(sshd_log)s This works ...
1
vote
0answers
10 views

Proper Fail2Ban Config Editing

There is some confusion left by various articles on the web about how to edit the Fail2Ban config files. For instance I wish to whitelist an IP address. Some say to copy the jail.conf to jail.local ...
0
votes
0answers
10 views

ipset del fonction not working?

I have fail2ban doing its job on Centos7. I use it a lot to monitor and unban stuff so I am comfortable with this. However I would like to play with ipset sometimes to understand its commands etc. ...
2
votes
1answer
349 views

fail2ban permanent ban: resource considerations / limits?

I recently installed fail2ban on a VPS ( Ubuntu 20.04 ), with a very simple configuration to disperse ssh brute-force attackers. I am using fail2ban with ufw ( banaction = ufw ) and I decided to ban ...
3
votes
1answer
4k views

How to get list banned ip and its unban time in fail2ban on Linux?

how to see a list of banned ip addresses and get its unban time? I know two methods to get list banned ip addresses. Via fail2ban client: sudo fail2ban-client status <jail name> Via iptables: ...
0
votes
1answer
94 views

Fail2ban Debian stretch roundcube-auth failregex doesnt work

Debian Stretch - roundcube-auth doesnt ban failed logins from IP. It seems like fileregex doesnt match logged failed logins. faile logins in /var/log/mail.log from roundcube is like Mar 30 16:15:31 ...
0
votes
1answer
55 views

String manipulation - get part after a certain word

Background: Although I think Fail2Ban is great way of securing subsystems like Apache, it takes a lot of work to get all the info together. So I'm writing a BASH script to do that for me. I need to ...
0
votes
2answers
48 views

APT upgrade fail2ban

I am trying to update Fail2Ban to include more recent changes they've included (specifically, catching Apache's Primary Script Unknown) errors. I am using Ubuntu 18 on a digital ocean droplet. When I ...
0
votes
1answer
332 views

How to configure Fail2ban with private key ssh connection on CentOs 7

I tried to install Fail2ban on my Centos 7 machine to prevent force brute connection on ssh server. I'm using a private key with a passphrase to connect. I tested Fail2ban but it doesn't block me ...
0
votes
1answer
142 views

fail2ban non-standard log file rotation

I am running an application that is managing the apache access logs on the server. The application is rotating the logs based on a size setting and is naming the logs by appending the date. example: ...
1
vote
1answer
889 views

I can't seem to get Fail2ban to successfully ban IP addresses that are trying to authenticate against our email server

Recently, my manager installed fail2ban on our ubuntu 10.04 email server to ban ip addresses that failed to authenticate to our email server. As we monitor the system, we don't see the IPs that ...
1
vote
1answer
39 views

IP traffic getting access even after blocking

There are multiple access records like the example I've provided below indicating traffic is allowed through to my system even after I have run these commands to deny this traffic. ufw deny from 78....
0
votes
1answer
969 views

fail2ban doesn't ban IP, but says to do it

I've fail2ban 0.9.6 working with iptables 1.6.2, and I'm using it to block an attacker that, since some days, has been teasing my email server (the typical Dovecot + Postfix installation). Everything ...
0
votes
1answer
85 views

What are Fail2ban duration accepted notations?

I've been searching around for the accepted duration formats for Fail2ban Jail configuration file (maybe it is not exclusive to F2B). I want to make sure which suffixes are valid when expressing an ...
2
votes
1answer
151 views

fail2ban 404 bruteforcing sharex

I use my own server (nginx, I use https://yunohost.org as a CP) as a screenshot uploader with ShareX (https://getsharex.com/). During the upload process of the screenshots the filenames are randomized....
0
votes
0answers
701 views

How can I get invalid users banned with fail2ban?

I have root login and password auth off. I have a custom jail.local with perm ban time and maxrety of 1. Invalid users are not getting banned. This is what one looks like Aug 8 11:36:51 TWS sshd[...
0
votes
0answers
25 views

sh(conf) script can not run php file

I am trying to run a php script within my fail2ban action file. When I disable selinux everything works fine, but when I enabled it again I get a constant error in my fail2ban log. php.conf (action) ...
0
votes
1answer
1k views

Properly configure fail2ban for ssh server in docker container

I have a configuration based fail2ban. I am running a container that runs an SSH service, and I am seeing a lot of "strange" connections. I have set docker to send the log of the container to Systemd'...
0
votes
0answers
95 views

How to block fake IP adresses?

on my webserver I find in the apache-logfiles: [Wed Jan 09 16:29:10.660069 2019] [:error] [pid 11705] [client 66.249.66.66:39066] script '/var/www/fairtragen/7327991037366506690.php' not found or ...
0
votes
1answer
1k views

How to have fail2ban reprocess log files?

I have installed and started fail2ban. Looking at apache and secure log, there are clearly a lot spam. But fail2ban did not block anything yet sudo iptables -L INPUT -v -n | less fail2ban-client ...
1
vote
1answer
882 views

fail2ban SSH with no password authentication

When I have disabled SSH password authentication, so we can only login using private key authentication, is there still a point in having fail2ban running for SSH brute force protection? I'm thinking ...
0
votes
1answer
42 views

Centos 7 , API calls makes IP banned

I have this problem with multiple cents 7 servers. When users make tomany calls (via API, e-mail or ssh) the server automatically bans the IP for X time. I already setup CSF + Fail2Ban, changed 'max ...
2
votes
1answer
999 views

fail2ban not catching SMTP password brute force attack

Spammers are running brute force password guessing attacks on my server (postfix on Debian). They have already guessed two user's passwords and started sending spam using my server. Passwords changed ...
0
votes
0answers
35 views

SSH: No connection from specific IP

On one of my VPS I'm facing a problem with SSH. I can't connect from home, but I can connect from other VPS. KiTTY gets Connection timeout and using the Windows command line telnet [host] 22 gets ...
1
vote
1answer
459 views

Fail2ban (0.9.6-2) with pure-ftpd (1.0.46)

I'm using pureftpd and fail2ban but is not working. It seems is able to read the log but the fail2ban.filter event is not triggered. I investigated a lot about all the possible problems and I already ...
0
votes
1answer
128 views

My IP gets banned on the server automatically

I need to know what program or what specific rule is banning my IP address as it happens often when I am programming. It will ban my router’s internal IP since I am connecting through the LAN. Then, ...
1
vote
0answers
437 views

safe fail2ban regex for postfix warning about hostname

I have a very low volume postfix install on my mail server. In fact, I am the only person receiving mails from it, albeit from a few different domains and mailboxes. Yesterday alone there were 811 ...
1
vote
2answers
1k views

How to install and configure Fail2ban 0.9.3-1 on Ubuntu 16.04? Any guide for beginners?

Well as simple as the question sounds but on the internet isn't anything which would help me here. Anyone know a good resource on the subject? Or maybe someone would like to describe the process here? ...
2
votes
1answer
2k views

fail2ban has maxretry of 3 but I see authentication failures repeated 5 times

I am running Ubuntu 16.04 with ssh enabled through ufw and have configured fail2ban to enable the [sshd] and [sshd-ddos] jails with a maxretry of 3 (i.e. I want to ban any ips that fail to ...
3
votes
0answers
570 views

What docker stack layout for nginx, ufw, fail2ban, and private services

I have an unraid server running some dockerized services (eg emby & seafile) that offer web interfaces which now need to be opened up in order to be accessible from outside the LAN. Never opened ...
3
votes
3answers
501 views

Power machine off after failed login attempts from physical access

I would like to know if there are any common techniques of powering your computer off after a number of failed login attempts from the machine locally (from the terminal login, or from lightdm for ...
0
votes
1answer
453 views

fail2ban/ipfw/Mac OS X server not denying connections

I am trying to set up some firewall for my 10.5 server, but I just cannot seem to get it to work. The main aim is to try to stop the constant brute force mail login attempts. To this end I installed ...
1
vote
1answer
996 views

fail2ban autoreport to abuseipdb.com

I want to create auto report to abuseipdb.com in fail2ban (Debian Jessie). Here is my /etc/fail2ban/action.d/abuseipdb.conf: [Definition] actionstart = actionstop = actioncheck = actionban = curl --...
1
vote
1answer
2k views

Fail2ban failed to start on Centos 7. Missing /var/log/secure file

A few days ago I bought vps and installed Centos 7 on it. Now I'm trying to set up fail2ban for ssh. I installed epel-release. Iptables was in use by default. This is what I'm getting when I'm trying ...
2
votes
1answer
274 views

Fail2ban-regex isn't working

I am trying to check the config on one of my filter jails but every time I run fail2ban-regex /path/to/log.log /path/to/filter.conf I get the following error: Traceback (most recent call last): ...
1
vote
1answer
6k views

Cant SSH into server, not responding

Short intro: I have 2 servers. Home server and in remote location Raspberry Pi. Both are running ssh, postfix (rpi as backup), bind (home server for lan only), squid3, fail2ban and other (possibly not ...
0
votes
0answers
491 views

Fail2ban update router firewall

Is it possible to update the router firewall with fail2ban instead of the firewall of the server machine? (I don't want to install a firewall to defend the server machine from the local network. I ...
0
votes
1answer
33 views

problems with installing fail2ban

sorry for my bad english, I'am not familiar with fail2ban , I need help in order to automaticly ban some ips who tries to connect on my server, I can't find the correct regex in order to let failban ...
2
votes
1answer
1k views

Fail2ban not working raspbian (ssh)

I just did a fresh install on my raspberry pi (Raspbian) and I can't get fail2ban to do anything, it doesn't block any failed ssh logins. I checked to make sure it was pointing at the correct log file ...
22
votes
1answer
11k views

What is 'Found' in Fail2Ban Log File?

I have multiple instances like the following in /var/log/fail2ban.log: 2015-12-27 14:31:21,949 fail2ban.filter [1020]: INFO [sshd] Found ###.###.###.### (Where # substitutes for a ...
8
votes
1answer
1k views

fail2ban ban multiply recidive hosts

We are using fail2ban on our web-facing servers to block IP addresses that repeatedly fail to authenticate properly. Our normal bantime hereby is one hour; IPs that have already been banned multiple ...
1
vote
2answers
1k views

Only allow whitelisted IP addresses to try to connect in fail2ban

My auth.log is littered with connection attempts from nasty zombies. It is really annoying. And the server doesn't even permit password logins. What I would like to do is set up fail2ban to only ...