We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [fail2ban]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
480 views

fail2ban doesn't ban IP, but says to do it

I've fail2ban 0.9.6 working with iptables 1.6.2, and I'm using it to block an attacker that, since some days, has been teasing my email server (the typical Dovecot + Postfix installation). Everything ...
0
votes
0answers
13 views

What are Fail2ban duration accepted notations?

I've been searching around for the accepted duration formats for Fail2ban Jail configuration file (maybe it is not exclusive to F2B). I want to make sure which suffixes are valid when expressing an ...
2
votes
1answer
23 views

fail2ban 404 bruteforcing sharex

I use my own server (nginx, I use https://yunohost.org as a CP) as a screenshot uploader with ShareX (https://getsharex.com/). During the upload process of the screenshots the filenames are randomized....
0
votes
0answers
48 views

How can I get invalid users banned with fail2ban?

I have root login and password auth off. I have a custom jail.local with perm ban time and maxrety of 1. Invalid users are not getting banned. This is what one looks like Aug 8 11:36:51 TWS sshd[...
0
votes
0answers
18 views

Fail2ban 0.9.6: Are password and failed passphrase attempts logged when using key authentification

I have installed fail2ban v0.9.6 on my raspberry pi jessie. I can access my pi from anywhere using ssh. I have set up port forwarding on my router and do not use port 22 externally but do use it ...
0
votes
0answers
33 views

rabbitmq access denied loggin to fail2ban

Im using rabbitmq with rabbitmq_management. if user input wrong login/pass in web panel, at /var/log/rabbitmq/rabbit.log I have logs like this: =WARNING REPORT==== 17-May-2019::06:58:56 === HTTP ...
0
votes
0answers
18 views

sh(conf) script can not run php file

I am trying to run a php script within my fail2ban action file. When I disable selinux everything works fine, but when I enabled it again I get a constant error in my fail2ban log. php.conf (action) ...
0
votes
0answers
58 views

How do I create a rule for 404 errors in Fail2Ban?

I created this rule on Fail2Ban to ban IPs that cause too many 404 errors. So far it is working, but sometimes I get lots of weird errors like this: 7f36e296b1c0 -- stderr: "Try `iptables -h' or '...
0
votes
1answer
410 views

Properly configure fail2ban for ssh server in docker container

I have a configuration based fail2ban. I am running a container that runs an SSH service, and I am seeing a lot of "strange" connections. I have set docker to send the log of the container to Systemd'...
0
votes
0answers
57 views

How to block fake IP adresses?

on my webserver I find in the apache-logfiles: [Wed Jan 09 16:29:10.660069 2019] [:error] [pid 11705] [client 66.249.66.66:39066] script '/var/www/fairtragen/7327991037366506690.php' not found or ...
0
votes
1answer
454 views

How to have fail2ban reprocess log files?

I have installed and started fail2ban. Looking at apache and secure log, there are clearly a lot spam. But fail2ban did not block anything yet sudo iptables -L INPUT -v -n | less fail2ban-client ...
1
vote
1answer
619 views

fail2ban SSH with no password authentication

When I have disabled SSH password authentication, so we can only login using private key authentication, is there still a point in having fail2ban running for SSH brute force protection? I'm thinking ...
0
votes
1answer
39 views

Centos 7 , API calls makes IP banned

I have this problem with multiple cents 7 servers. When users make tomany calls (via API, e-mail or ssh) the server automatically bans the IP for X time. I already setup CSF + Fail2Ban, changed 'max ...
2
votes
1answer
639 views

fail2ban not catching SMTP password brute force attack

Spammers are running brute force password guessing attacks on my server (postfix on Debian). They have already guessed two user's passwords and started sending spam using my server. Passwords changed ...
0
votes
0answers
32 views

SSH: No connection from specific IP

On one of my VPS I'm facing a problem with SSH. I can't connect from home, but I can connect from other VPS. KiTTY gets Connection timeout and using the Windows command line telnet [host] 22 gets ...
1
vote
1answer
271 views

Fail2ban (0.9.6-2) with pure-ftpd (1.0.46)

I'm using pureftpd and fail2ban but is not working. It seems is able to read the log but the fail2ban.filter event is not triggered. I investigated a lot about all the possible problems and I already ...
0
votes
1answer
117 views

My IP gets banned on the server automatically

I need to know what program or what specific rule is banning my IP address as it happens often when I am programming. It will ban my router’s internal IP since I am connecting through the LAN. Then, ...
1
vote
0answers
367 views

safe fail2ban regex for postfix warning about hostname

I have a very low volume postfix install on my mail server. In fact, I am the only person receiving mails from it, albeit from a few different domains and mailboxes. Yesterday alone there were 811 ...
1
vote
2answers
1k views

How to install and configure Fail2ban 0.9.3-1 on Ubuntu 16.04? Any guide for beginners?

Well as simple as the question sounds but on the internet isn't anything which would help me here. Anyone know a good resource on the subject? Or maybe someone would like to describe the process here? ...
2
votes
1answer
1k views

fail2ban has maxretry of 3 but I see authentication failures repeated 5 times

I am running Ubuntu 16.04 with ssh enabled through ufw and have configured fail2ban to enable the [sshd] and [sshd-ddos] jails with a maxretry of 3 (i.e. I want to ban any ips that fail to ...
3
votes
0answers
536 views

What docker stack layout for nginx, ufw, fail2ban, and private services

I have an unraid server running some dockerized services (eg emby & seafile) that offer web interfaces which now need to be opened up in order to be accessible from outside the LAN. Never opened ...
2
votes
2answers
312 views

Power machine off after failed login attempts from physical access

I would like to know if there are any common techniques of powering your computer off after a number of failed login attempts from the machine locally (from the terminal login, or from lightdm for ...
0
votes
1answer
395 views

fail2ban/ipfw/Mac OS X server not denying connections

I am trying to set up some firewall for my 10.5 server, but I just cannot seem to get it to work. The main aim is to try to stop the constant brute force mail login attempts. To this end I installed ...
1
vote
1answer
702 views

fail2ban autoreport to abuseipdb.com

I want to create auto report to abuseipdb.com in fail2ban (Debian Jessie). Here is my /etc/fail2ban/action.d/abuseipdb.conf: [Definition] actionstart = actionstop = actioncheck = actionban = curl --...
0
votes
1answer
2k views

Fail2ban failed to start on Centos 7. Missing /var/log/secure file

A few days ago I bought vps and installed Centos 7 on it. Now I'm trying to set up fail2ban for ssh. I installed epel-release. Iptables was in use by default. This is what I'm getting when I'm trying ...
2
votes
1answer
225 views

Fail2ban-regex isn't working

I am trying to check the config on one of my filter jails but every time I run fail2ban-regex /path/to/log.log /path/to/filter.conf I get the following error: Traceback (most recent call last): ...
0
votes
1answer
3k views

Cant SSH into server, not responding

Short intro: I have 2 servers. Home server and in remote location Raspberry Pi. Both are running ssh, postfix (rpi as backup), bind (home server for lan only), squid3, fail2ban and other (possibly not ...
0
votes
0answers
413 views

Fail2ban update router firewall

Is it possible to update the router firewall with fail2ban instead of the firewall of the server machine? (I don't want to install a firewall to defend the server machine from the local network. I ...
0
votes
1answer
31 views

problems with installing fail2ban

sorry for my bad english, I'am not familiar with fail2ban , I need help in order to automaticly ban some ips who tries to connect on my server, I can't find the correct regex in order to let failban ...
2
votes
1answer
915 views

Fail2ban not working raspbian (ssh)

I just did a fresh install on my raspberry pi (Raspbian) and I can't get fail2ban to do anything, it doesn't block any failed ssh logins. I checked to make sure it was pointing at the correct log file ...
17
votes
1answer
7k views

What is 'Found' in Fail2Ban Log File?

I have multiple instances like the following in /var/log/fail2ban.log: 2015-12-27 14:31:21,949 fail2ban.filter [1020]: INFO [sshd] Found ###.###.###.### (Where # substitutes for a ...
7
votes
1answer
1k views

fail2ban ban multiply recidive hosts

We are using fail2ban on our web-facing servers to block IP addresses that repeatedly fail to authenticate properly. Our normal bantime hereby is one hour; IPs that have already been banned multiple ...
0
votes
2answers
669 views

Only allow whitelisted IP addresses to try to connect in fail2ban

My auth.log is littered with connection attempts from nasty zombies. It is really annoying. And the server doesn't even permit password logins. What I would like to do is set up fail2ban to only ...
0
votes
0answers
142 views

How to see who's blocking my internet connection? fail2ban?

I was just running apt-get dist-upgrade from a distant ssh console when I lost the connection. I would like to know which service blocked my connection. I know fail2ban is sometime a bit flaky, but ...