Questions tagged [fail2ban]
anti-bruteforcing daemon that works on connection attempts to services such as SSH
114
questions
0
votes
1answer
53 views
How to configure fail2ban file?
I installed fail2ban but When I enter fail2ban-client status in the Linux terminal, I get the following warnings:
fail2ban.configreader [1616]: ERROR Found no accessible config files for 'filter.d/...
1
vote
2answers
34 views
Is fail2ban required if already using firewalld and restricting ssh
I have seen a lot of posts showing how to install fail2ban along with firewalld and wanted to know if fail2ban is really required for my set up.
My set up is as follows
Cent OS 8 in a VPS
Public ...
0
votes
0answers
32 views
Fail2Ban - how to modify the sshd-aggressive profile
I'd like to implement permaban for the sshd-aggressive mode. I see the mode-specific filter definitions in /etc/fail2ban/filter.d/sshd.conf, but I can't find anything in jail or action confs that ...
1
vote
0answers
16 views
How can I enable/disable a jail using fail2ban?
We can add a line like this below a specific jail in the jail.local file, and control the jail:
enabled = true/false
But I think there should be a command to do this, as we've got bunch of "set&...
0
votes
0answers
9 views
Can't start fail2ban with banaction = ufw
After I change banaction = iptables-multiport to banaction = ufw in /etc/fail2ban/jail.local, the fail2ban service fails to start.
How to use ufw as a banaction in debain 10?
0
votes
1answer
115 views
Server being attacked with key exchange attempts. Not being added to ban list by fail2ban
Looking through the sshd logs, there is a remote machine which appears to be attacking my server. here is an example of an entry. It is always the same IP.
May 8 17:57:32 [removed] sshd[99267]: ...
0
votes
2answers
75 views
How to prevent unban in fail2ban?
After configuring a port 22 forward from my router to my raspberry pi, I found that there were a TON of IPs trying to get in daily. I have tried to make my system more secure by setting up ufw and ...
1
vote
1answer
8k views
SSH “kex_exchange_identification: read: Connection reset by peer”
The setup:
Raspberry 3B running Raspbian Stretch 9 on an external HDD and using ZRAM
Raspi used as a webserver running LAMP and MERN stacks and accessed remotely via SSH with 1 IDE (Coda for Mac OS)
...
0
votes
0answers
119 views
Fail2ban multiple actions
I am trying to create a jail for fail2ban, where upon a regex match I want to block the source IP from reaching either port 80 or 443 on my server.
I've tried variations of this:
action = iptables[...
0
votes
1answer
130 views
Can't find where to enabled Fail2Ban Features - Ubuntu
I followed a site to install and configure Fail2Ban
apt-get update && apt-get upgrade -y
apt-get install fail2ban
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
cat jail.local
I ...
1
vote
1answer
37 views
What should I check when I can't SSH into my box?
I update my :
/etc/ssh/sshd_config, update port from 22 to 558
/etc/fail2ban/jail.local, update port from 22 to 558
add a new record in iptables
iptables -A INPUT -p tcp -m multiport --dports 558 -...
2
votes
0answers
1k views
Fail2ban & nftables errors, IPs not banned
So I've been experimenting with nftables in CentOS 8 and things are going pretty well, but I'm having a weird problem with fail2ban.
Fail2ban cannot ban IPs with nftables-multiport or nftables-...
1
vote
2answers
243 views
How can I hide failed ssh attempts for users that don't exist?
The Question
How can I exclude inconsequentialĀ¹ failed SSH logins?
Background
For ambient awareness, I like to have little background windows showing system error logs on every GNU/Linux box I ...
0
votes
1answer
16 views
How to configure fail2ban without a log file?
I am trying to configure a policy in fail2ban - the detection and identity of bad behaviour is rather complex in my case, so I was planning to handle this in a dedicated program. Rather than having ...
2
votes
1answer
509 views
fail2ban applying ban but is not blocking the connection
I have a fail2ban setup enabled for sshd on CentOS. It is reading the logs fine. Doing some testing with SSH failed logins from a remote server:
Nov 23 20:51:52 new fail2ban.filter[29090]: INFO [sshd]...
0
votes
0answers
122 views
Fail2ban not reading zimbra.log file from Zimbra Collaboration Suite 8.8.7 inside a docker
We use Zimbra Collaboration Suite 8.8.7 here inside a docker container. Zimbra is logging at /var/log/zimbra.log. Outside docker this file is at /zpool/zimbra/opt/log/zimbra.log.
tail -f /zpool/...
7
votes
1answer
223 views
Large fail2ban database, normal?
The fail2ban database on my server is quite large (420MB).
The fail2ban log is quite busy (there is a "filter" entry every two seconds) but iptables shows only a few banned addresses.
dbpurgeage is ...
0
votes
0answers
27 views
Fail2Ban does not want to run
I have this error when i lauchn Fail2Ban Service:
systemctl status fail2ban.service
ā fail2ban.service - Fail2Ban Service
Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; enabled; vendor ...
0
votes
1answer
53 views
Can't Start Fail2Ban
Lately I got 3 emails from Fail2Ban
The jail nginx-http-auth has been stopped.
The jail nginx-badbots has been stopped.
The jail ssh has been stopped.
Then I start SSH into my VM, this is the log
...
-2
votes
1answer
28 views
Fail2ban adding new chain
how to create a new chain that appear in first position (before recidive) that create iptables rules to block an entire IP class if recidive has N IP's of that block?
thx in advance
0
votes
1answer
54 views
Bulk login attempts on port 22 shutdown our SSH git server access, HTTPs still works though
Recently we have been seeing a lot of connections from IPs in to our public git server. When this happens, our devs are unable to commit via SSH as the server is very, very slow and I am unable to ...
0
votes
0answers
939 views
Failed use Fail2ban: No file(s) found for glob /var/log/audit/audit.log
I'm tring use a Fail2ban on Raspbian follow this tutorial, but it didn't work, and appear this error:
root@raspberrypi:~# fail2ban-server
No file(s) found for glob /var/log/audit/audit.log
Failed ...
0
votes
1answer
48 views
Changed ssh port to 1234, can't connect to server, fail2ban in use
I just changed my ssh port to 1234 and now i cant access my server any more.
Also I set AllowUsers stephan in /etc/ssh/sshd_config
I have fail2ban installed and i am trying to login as root user. ...
0
votes
2answers
174 views
REGEX: flush a number of related chains in iptables
I want to flush a number of related chains in IPtables. Their names like 'f2b.*'
I want the entire chain gone!
e.g. all this gone.
-A f2b-postfix-sasl -s 103.231.139.130/32 -j REJECT --reject-with ...
1
vote
0answers
156 views
fail2ban not detecting ssh failures on CentOS 7
I've installed fail2ban on CentOS 7 and added jail.local:
[sshd]
enabled = true
When I try a bad ssh login, I get a log entry in /var/log/secure like this:
Jun 5 11:09:40 arsenal sshd[32595]: ...
0
votes
0answers
144 views
fail2ban not blocking access to imap ports
I have a mail server with dovecot. I run fail2ban on it, with the jail [dovecot] enabled. Here is the status of that jail.
# fail2ban-client status dovecot
Status for the jail: dovecot
|- Filter
| |...
3
votes
2answers
2k views
How to show “number of failed login attempts” on a successful ssh login?
I use CentOS 7 on a host. There used to be a report of the number of failed login attempts shown whenever I logged into the machine using SSH. The full banner was something like this:
Last failed ...
0
votes
1answer
109 views
iptables Performance with long chains
I'd like to know if long chains in iptables is likely to cause a performance issue. Here a long chain might be >2,500 individual IP bans.
My concern is that my limited knowledge of iptables suggests ...
4
votes
0answers
244 views
fail2ban too slow, banning after the attack
We had a "register"-attack to our voip server (freeswitch).
In the Logs it looks something like this:
2019-04-25 14:35:16.137965 [WARNING] sofia_reg.c:1743 SIP auth failure (REGISTER) on sofia ...
0
votes
1answer
37 views
UFW Syntax to find and delete ONE rule among 4279 UFW REJECT IN rules
I've setup Fail2Ban to use UFW actions to permanently ban IPs after 1 failed attempt. What seemed like a good idea are now causing me problems as I need to remove one IP among all those ufw rules.
...
3
votes
0answers
116 views
Why fail2ban would ban an IP that is whitelisted (on ignoreip)?
I have fail2ban configured to protect the authentication on a postfix service.
The jail is working properly on the ban side, but the ignoreip option seems to be ignored or misconfigured since it bans ...
0
votes
1answer
130 views
Fail2ban regex: how to NOT get host name but ip?
In my access.log I got somerow a
ip - - [date] method link ... etc..
and some others with
www.domain.com:ip - - [date] method link ... etc..
I am actually using this regexp
^<HOST>.*/...
2
votes
1answer
630 views
fail2ban has banned my Ip but I can still login using SSH
I done a fresh new install of fail2ban on a Debian 9.8
I copied /etc/fail2ban/jail.conf as jail.local.
And in my jail.local in added enabled=true under [ssh]
Tailing fail2ban's log I can see what ...
1
vote
1answer
1k views
Docker between-container iptables and fail2ban?
Say I have a public-facing Nginx reverse proxy container (A) that sends traffic to a downstream web service (B). This A container is where TLS connections terminate. The Docker server is also behind ...
2
votes
1answer
166 views
fail2ban will not ban again after first one expires
I couldn't make fail2ban to block IP address coming up in postfix log on Debian 9. I rewrote the failregex to be like this:
NOQUEUE: reject: RCPT from (.*)\[<HOST>\]:(.*) 550 5.7.1 Service ...
0
votes
0answers
765 views
Why does fail2ban not trigger my custom filter?
fail2ban-regex verified that my filter matches Jan 14 07:39:41 myhost01 sshd[26433]: Connection closed by authenticating user root 127.0.0.1 port 56216 [preauth] 68 times inside auth.log, but fail2ban-...
3
votes
1answer
4k views
How to automatically permanently ban IP addresses?
Currently I have been using iptables on a new Debian server running Asterisk.
Every day I have been checking auth.log for IP addresses and manually doing iptables -A INPUT -s IPA.DRE.SS.0/24 -j DROP
...
0
votes
1answer
124 views
Fail2ban Debian 9, freeswitch
My server goes crazy with the CPU when I reload fail2ban and sometimes mid day as well the CPU goes very high.
I remember a while ago I was told to switch to systemd, any idea on how to do it?
3
votes
1answer
632 views
mosquitto bruteforce fail2ban failregex
I am trying to write fail2ban filter to block bruteforcing IP addresses which are trying to subscribe to username/password protected mosquitto service by guessing username/password combinations.
On ...
3
votes
1answer
1k views
fail2ban with iptables-persistent
I've been running fail2ban for a bit, and recently installed iptables-persistent and am using it with ipset for a blacklist (there's one particular IP that is always hammering away at this machine). ...
0
votes
1answer
177 views
Can't install fail2ban on CentOS 6.9
I can't install fail2ban on my CentOS 6.9. Here is my config
# cat /etc/*release
CentOS release 6.9 (Final)
CentOS release 6.9 (Final)
CentOS release 6.9 (Final)
# rpm -q epel-release
epel-release-...
0
votes
1answer
514 views
fail2ban fails 2 ban login attemps to smtp (postfix) server in docker container
I got a problem with my host / docker setting as follows:
Host runs fail2ban, which accesses the mail.log files from the docker container, which are mapped over a volume. This all works fine, I ...
1
vote
1answer
165 views
fail2ban conf file
I'm running:
Fail2Ban v0.9.6
on Debian 9.4 (4.9.0-6-amd64 #1 SMP Debian 4.9.88-1+deb9u1 (2018-05-07) x86_64 GNU/Linux)
This is my F2B directory:
$ la -al /etc/fail2ban
total 72K
drwxr-xr-x 6 ...
0
votes
1answer
227 views
Run fail2ban-regex by piping with zcat?
Normally running the command would go like this:
$ fail2ban-regex /var/log/ningx/access.log \
/etc/fail2ban/filter.d/nginx-noscript.conf -v
However, I have multiple files that I'd like to parse ...
5
votes
1answer
2k views
How does fail2ban protect against DDoS?
How does fail2ban protect against SSH DDoS attacks? What does it do in the case of a DDoS attack? And how does it determine if it is a DDoS?
I am asking only about DDoS attacks.
(I assume it really ...
0
votes
2answers
949 views
Can't list any iptables rules with iptables -Lvn
I just installed fail2ban and when I wanted to check if ssh iptables jail is running. That is when I saw that iptables -Lvn list nothing. Iptables are running with custom script but I have no idea why ...
2
votes
3answers
4k views
fail2ban keeps saying already banned but it didn't actually ban
I just configured a new server and installed fail2ban as well, but it is not banning me when I keep trying to connect with the wrong password
fail2ban.log:
2018-03-23 12:46:29,363 fail2ban.actions ...
0
votes
2answers
2k views
Fedora : fail2ban will not show up in iptables -L
I have Fedora installed on one of our servers and installed fail2ban on it. In jail.conf, I have added the below text, but iptables -L still wont show the fail2ban-ssh. Am I missing something?
Text ...
0
votes
1answer
208 views
How can I get fail2ban to install on Centos 7.4?
I've done yum install epel-release and this shows in my repolist:
repo id repo name ...
0
votes
1answer
624 views
Block all IPs for SSH/SSHD with iptables/fail2ban or firewalld?
I'm trying to learn Linux and get familiar with it. How do I block all IPs except two certain IPs on different subnets for SSH/SSHD? I've been trying to Google for an answer but nothing seem to work ...
