Questions tagged [fail2ban]
anti-bruteforcing daemon that works on connection attempts to services such as SSH
120
questions
1
vote
1answer
38 views
How can I use fail2ban with ipv6?
I have used the Fail2ban for a long time. I think this script is not able to manage the IPv6 -- or maybe it is working with IPv6?
How can I prevent IPv6 attacks with Fail2ban or do I have to search ...
0
votes
1answer
32 views
Writing a fail2ban multiline regex
I'm not sure if this the correct regex, but i'm trying to add multiple lines at the ignoreregex
Here are the config lines in my ddos.conf:
[Definition]
failregex = ^<HOST> -.*"(GET|POST).*
...
2
votes
2answers
93 views
fail2ban and iptables rules flood (resulting in poor bandwidth)
I've noticed this pattern happening a few times on my server in the last 6 months:
First, fail2ban detects many SSH attempts from bots, and sucessfully bans them. Indeed in /etc/fail2ban/jail.conf I ...
1
vote
0answers
56 views
Blocking FTP Brute Force Attack with Snort
I am trying to become familiar with Snort, and for this reason, I have set three VMs. A Kali, a windows machine with XAMPP and Ubuntu where I installed Snort.
I believe I have Snort running in ...
0
votes
1answer
55 views
fail2ban - have more than one regex in same filter file
I have the following in my fail2ban/filter.d/apache-scripts.conf file:
[INCLUDES] before = botsearch-common.conf
[Definition]
failregex = (<HOST>).*(GET|HEAD|POST|PUT)\ \/(site\/|blog\/|old\/|...
0
votes
1answer
202 views
Fail2Ban Regex - NGNIX - Custom Regex
I am trying to create a custom log file for fail2ban NGNIX logs to catch a specific event. Regex is still relatively new to me so im trying to improve. This will be put into a custom filter but for ...
1
vote
0answers
116 views
fail2ban not banning ssh
Trying to setup fail2ban sshd on Ubuntu 20.
# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
| |- Currently failed: 0
| |- Total failed: 0
| `- File list: /var/log/auth....
0
votes
0answers
26 views
TCPDump : ghost connection
here is the tcpdump capture.
10:57:41.678675 IP (tos 0x0, ttl 173, id 26512, offset 0, flags [none], proto TCP (6), length 40) 194.26.25.102.55243 > XXX.XXX.XXX.XXX.10000: Flags [S], cksum 0x4f11 (...
0
votes
1answer
113 views
How to configure fail2ban file?
I installed fail2ban but When I enter fail2ban-client status in the Linux terminal, I get the following warnings:
fail2ban.configreader [1616]: ERROR Found no accessible config files for 'filter.d/...
1
vote
2answers
52 views
Is fail2ban required if already using firewalld and restricting ssh
I have seen a lot of posts showing how to install fail2ban along with firewalld and wanted to know if fail2ban is really required for my set up.
My set up is as follows
Cent OS 8 in a VPS
Public ...
0
votes
0answers
157 views
Fail2Ban - how to modify the sshd-aggressive profile
I'd like to implement permaban for the sshd-aggressive mode. I see the mode-specific filter definitions in /etc/fail2ban/filter.d/sshd.conf, but I can't find anything in jail or action confs that ...
1
vote
0answers
47 views
How can I enable/disable a jail using fail2ban?
We can add a line like this below a specific jail in the jail.local file, and control the jail:
enabled = true/false
But I think there should be a command to do this, as we've got bunch of "set&...
0
votes
0answers
40 views
Can't start fail2ban with banaction = ufw
After I change banaction = iptables-multiport to banaction = ufw in /etc/fail2ban/jail.local, the fail2ban service fails to start.
How to use ufw as a banaction in debain 10?
0
votes
1answer
481 views
Server being attacked with key exchange attempts. Not being added to ban list by fail2ban
Looking through the sshd logs, there is a remote machine which appears to be attacking my server. here is an example of an entry. It is always the same IP.
May 8 17:57:32 [removed] sshd[99267]: ...
0
votes
2answers
374 views
How to prevent unban in fail2ban?
After configuring a port 22 forward from my router to my raspberry pi, I found that there were a TON of IPs trying to get in daily. I have tried to make my system more secure by setting up ufw and ...
1
vote
1answer
18k views
SSH “kex_exchange_identification: read: Connection reset by peer”
The setup:
Raspberry 3B running Raspbian Stretch 9 on an external HDD and using ZRAM
Raspi used as a webserver running LAMP and MERN stacks and accessed remotely via SSH with 1 IDE (Coda for Mac OS)
...
0
votes
1answer
397 views
Fail2ban multiple actions
I am trying to create a jail for fail2ban, where upon a regex match I want to block the source IP from reaching either port 80 or 443 on my server.
I've tried variations of this:
action = iptables[...
0
votes
1answer
226 views
Can't find where to enabled Fail2Ban Features - Ubuntu
I followed a site to install and configure Fail2Ban
apt-get update && apt-get upgrade -y
apt-get install fail2ban
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
cat jail.local
I ...
1
vote
1answer
38 views
What should I check when I can't SSH into my box?
I update my :
/etc/ssh/sshd_config, update port from 22 to 558
/etc/fail2ban/jail.local, update port from 22 to 558
add a new record in iptables
iptables -A INPUT -p tcp -m multiport --dports 558 -...
3
votes
0answers
2k views
Fail2ban & nftables errors, IPs not banned
So I've been experimenting with nftables in CentOS 8 and things are going pretty well, but I'm having a weird problem with fail2ban.
Fail2ban cannot ban IPs with nftables-multiport or nftables-...
1
vote
2answers
482 views
How can I hide failed ssh attempts for users that don't exist?
The Question
How can I exclude inconsequential¹ failed SSH logins?
Background
For ambient awareness, I like to have little background windows showing system error logs on every GNU/Linux box I ...
0
votes
1answer
33 views
How to configure fail2ban without a log file?
I am trying to configure a policy in fail2ban - the detection and identity of bad behaviour is rather complex in my case, so I was planning to handle this in a dedicated program. Rather than having ...
4
votes
1answer
905 views
fail2ban applying ban but is not blocking the connection
I have a fail2ban setup enabled for sshd on CentOS. It is reading the logs fine. Doing some testing with SSH failed logins from a remote server:
Nov 23 20:51:52 new fail2ban.filter[29090]: INFO [sshd]...
7
votes
1answer
724 views
Large fail2ban database, normal?
The fail2ban database on my server is quite large (420MB).
The fail2ban log is quite busy (there is a "filter" entry every two seconds) but iptables shows only a few banned addresses.
dbpurgeage is ...
0
votes
1answer
57 views
Can't Start Fail2Ban
Lately I got 3 emails from Fail2Ban
The jail nginx-http-auth has been stopped.
The jail nginx-badbots has been stopped.
The jail ssh has been stopped.
Then I start SSH into my VM, this is the log
...
-2
votes
1answer
31 views
Fail2ban adding new chain
how to create a new chain that appear in first position (before recidive) that create iptables rules to block an entire IP class if recidive has N IP's of that block?
thx in advance
0
votes
1answer
90 views
Bulk login attempts on port 22 shutdown our SSH git server access, HTTPs still works though
Recently we have been seeing a lot of connections from IPs in to our public git server. When this happens, our devs are unable to commit via SSH as the server is very, very slow and I am unable to ...
0
votes
0answers
1k views
Failed use Fail2ban: No file(s) found for glob /var/log/audit/audit.log
I'm tring use a Fail2ban on Raspbian follow this tutorial, but it didn't work, and appear this error:
root@raspberrypi:~# fail2ban-server
No file(s) found for glob /var/log/audit/audit.log
Failed ...
0
votes
1answer
100 views
Changed ssh port to 1234, can't connect to server, fail2ban in use
I just changed my ssh port to 1234 and now i cant access my server any more.
Also I set AllowUsers stephan in /etc/ssh/sshd_config
I have fail2ban installed and i am trying to login as root user. ...
0
votes
2answers
264 views
REGEX: flush a number of related chains in iptables
I want to flush a number of related chains in IPtables. Their names like 'f2b.*'
I want the entire chain gone!
e.g. all this gone.
-A f2b-postfix-sasl -s 103.231.139.130/32 -j REJECT --reject-with ...
1
vote
0answers
223 views
fail2ban not detecting ssh failures on CentOS 7
I've installed fail2ban on CentOS 7 and added jail.local:
[sshd]
enabled = true
When I try a bad ssh login, I get a log entry in /var/log/secure like this:
Jun 5 11:09:40 arsenal sshd[32595]: ...
0
votes
0answers
158 views
fail2ban not blocking access to imap ports
I have a mail server with dovecot. I run fail2ban on it, with the jail [dovecot] enabled. Here is the status of that jail.
# fail2ban-client status dovecot
Status for the jail: dovecot
|- Filter
| |...
3
votes
2answers
3k views
How to show “number of failed login attempts” on a successful ssh login?
I use CentOS 7 on a host. There used to be a report of the number of failed login attempts shown whenever I logged into the machine using SSH. The full banner was something like this:
Last failed ...
0
votes
1answer
206 views
iptables Performance with long chains
I'd like to know if long chains in iptables is likely to cause a performance issue. Here a long chain might be >2,500 individual IP bans.
My concern is that my limited knowledge of iptables suggests ...
4
votes
0answers
369 views
fail2ban too slow, banning after the attack
We had a "register"-attack to our voip server (freeswitch).
In the Logs it looks something like this:
2019-04-25 14:35:16.137965 [WARNING] sofia_reg.c:1743 SIP auth failure (REGISTER) on sofia ...
0
votes
1answer
66 views
UFW Syntax to find and delete ONE rule among 4279 UFW REJECT IN rules
I've setup Fail2Ban to use UFW actions to permanently ban IPs after 1 failed attempt. What seemed like a good idea are now causing me problems as I need to remove one IP among all those ufw rules.
...
3
votes
0answers
177 views
Why fail2ban would ban an IP that is whitelisted (on ignoreip)?
I have fail2ban configured to protect the authentication on a postfix service.
The jail is working properly on the ban side, but the ignoreip option seems to be ignored or misconfigured since it bans ...
0
votes
1answer
154 views
Fail2ban regex: how to NOT get host name but ip?
In my access.log I got somerow a
ip - - [date] method link ... etc..
and some others with
www.domain.com:ip - - [date] method link ... etc..
I am actually using this regexp
^<HOST>.*/...
2
votes
1answer
911 views
fail2ban has banned my Ip but I can still login using SSH
I done a fresh new install of fail2ban on a Debian 9.8
I copied /etc/fail2ban/jail.conf as jail.local.
And in my jail.local in added enabled=true under [ssh]
Tailing fail2ban's log I can see what ...
1
vote
1answer
2k views
Docker between-container iptables and fail2ban?
Say I have a public-facing Nginx reverse proxy container (A) that sends traffic to a downstream web service (B). This A container is where TLS connections terminate. The Docker server is also behind ...
2
votes
1answer
187 views
fail2ban will not ban again after first one expires
I couldn't make fail2ban to block IP address coming up in postfix log on Debian 9. I rewrote the failregex to be like this:
NOQUEUE: reject: RCPT from (.*)\[<HOST>\]:(.*) 550 5.7.1 Service ...
0
votes
0answers
963 views
Why does fail2ban not trigger my custom filter?
fail2ban-regex verified that my filter matches Jan 14 07:39:41 myhost01 sshd[26433]: Connection closed by authenticating user root 127.0.0.1 port 56216 [preauth] 68 times inside auth.log, but fail2ban-...
4
votes
1answer
5k views
How to automatically permanently ban IP addresses?
Currently I have been using iptables on a new Debian server running Asterisk.
Every day I have been checking auth.log for IP addresses and manually doing iptables -A INPUT -s IPA.DRE.SS.0/24 -j DROP
...
0
votes
1answer
145 views
Fail2ban Debian 9, freeswitch
My server goes crazy with the CPU when I reload fail2ban and sometimes mid day as well the CPU goes very high.
I remember a while ago I was told to switch to systemd, any idea on how to do it?
3
votes
1answer
881 views
mosquitto bruteforce fail2ban failregex
I am trying to write fail2ban filter to block bruteforcing IP addresses which are trying to subscribe to username/password protected mosquitto service by guessing username/password combinations.
On ...
4
votes
1answer
1k views
fail2ban with iptables-persistent
I've been running fail2ban for a bit, and recently installed iptables-persistent and am using it with ipset for a blacklist (there's one particular IP that is always hammering away at this machine). ...
0
votes
1answer
205 views
Can't install fail2ban on CentOS 6.9
I can't install fail2ban on my CentOS 6.9. Here is my config
# cat /etc/*release
CentOS release 6.9 (Final)
CentOS release 6.9 (Final)
CentOS release 6.9 (Final)
# rpm -q epel-release
epel-release-...
0
votes
1answer
688 views
fail2ban fails 2 ban login attemps to smtp (postfix) server in docker container
I got a problem with my host / docker setting as follows:
Host runs fail2ban, which accesses the mail.log files from the docker container, which are mapped over a volume. This all works fine, I ...
1
vote
1answer
221 views
fail2ban conf file
I'm running:
Fail2Ban v0.9.6
on Debian 9.4 (4.9.0-6-amd64 #1 SMP Debian 4.9.88-1+deb9u1 (2018-05-07) x86_64 GNU/Linux)
This is my F2B directory:
$ la -al /etc/fail2ban
total 72K
drwxr-xr-x 6 ...
0
votes
1answer
256 views
Run fail2ban-regex by piping with zcat?
Normally running the command would go like this:
$ fail2ban-regex /var/log/ningx/access.log \
/etc/fail2ban/filter.d/nginx-noscript.conf -v
However, I have multiple files that I'd like to parse ...
