Questions tagged [fail2ban]

anti-bruteforcing daemon that works on connection attempts to services such as SSH

Filter by
Sorted by
Tagged with
0
votes
0answers
15 views

Fail2ban multiple actions

I am trying to create a jail for fail2ban, where upon a regex match I want to block the source IP from reaching either port 80 or 443 on my server. I've tried variations of this: action = iptables[...
0
votes
0answers
73 views

Can't find where to enabled Fail2Ban Features - Ubuntu

I followed a site to install and configure Fail2Ban apt-get update && apt-get upgrade -y apt-get install fail2ban cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local cat jail.local I ...
1
vote
1answer
36 views

What should I check when I can't SSH into my box?

I update my : /etc/ssh/sshd_config, update port from 22 to 558 /etc/fail2ban/jail.local, update port from 22 to 558 add a new record in iptables iptables -A INPUT -p tcp -m multiport --dports 558 -...
2
votes
0answers
370 views

Fail2ban & nftables errors, IPs not banned

So I've been experimenting with nftables in CentOS 8 and things are going pretty well, but I'm having a weird problem with fail2ban. Fail2ban cannot ban IPs with nftables-multiport or nftables-...
0
votes
1answer
66 views

How can I hide failed ssh attempts for users that don't exist?

The Question How can I exclude inconsequential¹ failed SSH logins? Background For ambient awareness, I like to have little background windows showing system error logs on every GNU/Linux box I ...
0
votes
1answer
15 views

How to configure fail2ban without a log file?

I am trying to configure a policy in fail2ban - the detection and identity of bad behaviour is rather complex in my case, so I was planning to handle this in a dedicated program. Rather than having ...
2
votes
1answer
200 views

fail2ban applying ban but is not blocking the connection

I have a fail2ban setup enabled for sshd on CentOS. It is reading the logs fine. Doing some testing with SSH failed logins from a remote server: Nov 23 20:51:52 new fail2ban.filter[29090]: INFO [sshd]...
0
votes
0answers
47 views

Fail2ban not reading zimbra.log file from Zimbra Collaboration Suite 8.8.7 inside a docker

We use Zimbra Collaboration Suite 8.8.7 here inside a docker container. Zimbra is logging at /var/log/zimbra.log. Outside docker this file is at /zpool/zimbra/opt/log/zimbra.log. tail -f /zpool/...
4
votes
0answers
49 views

Large fail2ban database, normal?

The fail2ban database on my server is quite large (420MB). The fail2ban log is quite busy (there is a "filter" entry every two seconds) but iptables shows only a few banned addresses. dbpurgeage is ...
0
votes
0answers
26 views

Fail2Ban does not want to run

I have this error when i lauchn Fail2Ban Service: systemctl status fail2ban.service ● fail2ban.service - Fail2Ban Service Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; enabled; vendor ...
0
votes
1answer
37 views

Can't Start Fail2Ban

Lately I got 3 emails from Fail2Ban The jail nginx-http-auth has been stopped. The jail nginx-badbots has been stopped. The jail ssh has been stopped. Then I start SSH into my VM, this is the log ...
-2
votes
1answer
24 views

Fail2ban adding new chain

how to create a new chain that appear in first position (before recidive) that create iptables rules to block an entire IP class if recidive has N IP's of that block? thx in advance
0
votes
1answer
45 views

Bulk login attempts on port 22 shutdown our SSH git server access, HTTPs still works though

Recently we have been seeing a lot of connections from IPs in to our public git server. When this happens, our devs are unable to commit via SSH as the server is very, very slow and I am unable to ...
0
votes
0answers
472 views

Failed use Fail2ban: No file(s) found for glob /var/log/audit/audit.log

I'm tring use a Fail2ban on Raspbian follow this tutorial, but it didn't work, and appear this error: root@raspberrypi:~# fail2ban-server No file(s) found for glob /var/log/audit/audit.log Failed ...
0
votes
1answer
31 views

Changed ssh port to 1234, can't connect to server, fail2ban in use

I just changed my ssh port to 1234 and now i cant access my server any more. Also I set AllowUsers stephan in /etc/ssh/sshd_config I have fail2ban installed and i am trying to login as root user. ...
0
votes
0answers
18 views

Strange ban when attempting to make request on a server

I am currently getting banned, every time I try to make a REST request onto an Elasticsearch server hosted inside a LXC container. The host of LXC containers is a Debian Stretch. The Ban is not only ...
0
votes
2answers
107 views

REGEX: flush a number of related chains in iptables

I want to flush a number of related chains in IPtables. Their names like 'f2b.*' I want the entire chain gone! e.g. all this gone. -A f2b-postfix-sasl -s 103.231.139.130/32 -j REJECT --reject-with ...
1
vote
0answers
108 views

fail2ban not detecting ssh failures on CentOS 7

I've installed fail2ban on CentOS 7 and added jail.local: [sshd] enabled = true When I try a bad ssh login, I get a log entry in /var/log/secure like this: Jun 5 11:09:40 arsenal sshd[32595]: ...
0
votes
0answers
119 views

fail2ban not blocking access to imap ports

I have a mail server with dovecot. I run fail2ban on it, with the jail [dovecot] enabled. Here is the status of that jail. # fail2ban-client status dovecot Status for the jail: dovecot |- Filter | |...
3
votes
2answers
867 views

How to show “number of failed login attempts” on a successful ssh login?

I use CentOS 7 on a host. There used to be a report of the number of failed login attempts shown whenever I logged into the machine using SSH. The full banner was something like this: Last failed ...
0
votes
1answer
66 views

iptables Performance with long chains

I'd like to know if long chains in iptables is likely to cause a performance issue. Here a long chain might be >2,500 individual IP bans. My concern is that my limited knowledge of iptables suggests ...
4
votes
0answers
141 views

fail2ban too slow, banning after the attack

We had a "register"-attack to our voip server (freeswitch). In the Logs it looks something like this: 2019-04-25 14:35:16.137965 [WARNING] sofia_reg.c:1743 SIP auth failure (REGISTER) on sofia ...
0
votes
1answer
30 views

UFW Syntax to find and delete ONE rule among 4279 UFW REJECT IN rules

I've setup Fail2Ban to use UFW actions to permanently ban IPs after 1 failed attempt. What seemed like a good idea are now causing me problems as I need to remove one IP among all those ufw rules. ...
3
votes
0answers
101 views

Why fail2ban would ban an IP that is whitelisted (on ignoreip)?

I have fail2ban configured to protect the authentication on a postfix service. The jail is working properly on the ban side, but the ignoreip option seems to be ignored or misconfigured since it bans ...
0
votes
1answer
111 views

Fail2ban regex: how to NOT get host name but ip?

In my access.log I got somerow a ip - - [date] method link ... etc.. and some others with www.domain.com:ip - - [date] method link ... etc.. I am actually using this regexp ^<HOST>.*/...
1
vote
1answer
411 views

fail2ban has banned my Ip but I can still login using SSH

I done a fresh new install of fail2ban on a Debian 9.8 I copied /etc/fail2ban/jail.conf as jail.local. And in my jail.local in added enabled=true under [ssh] Tailing fail2ban's log I can see what ...
1
vote
1answer
678 views

Docker between-container iptables and fail2ban?

Say I have a public-facing Nginx reverse proxy container (A) that sends traffic to a downstream web service (B). This A container is where TLS connections terminate. The Docker server is also behind ...
2
votes
1answer
132 views

fail2ban will not ban again after first one expires

I couldn't make fail2ban to block IP address coming up in postfix log on Debian 9. I rewrote the failregex to be like this: NOQUEUE: reject: RCPT from (.*)\[<HOST>\]:(.*) 550 5.7.1 Service ...
0
votes
0answers
478 views

Why does fail2ban not trigger my custom filter?

fail2ban-regex verified that my filter matches Jan 14 07:39:41 myhost01 sshd[26433]: Connection closed by authenticating user root 127.0.0.1 port 56216 [preauth] 68 times inside auth.log, but fail2ban-...
3
votes
1answer
3k views

How to automatically permanently ban IP addresses?

Currently I have been using iptables on a new Debian server running Asterisk. Every day I have been checking auth.log for IP addresses and manually doing iptables -A INPUT -s IPA.DRE.SS.0/24 -j DROP ...
0
votes
1answer
96 views

Fail2ban Debian 9, freeswitch

My server goes crazy with the CPU when I reload fail2ban and sometimes mid day as well the CPU goes very high. I remember a while ago I was told to switch to systemd, any idea on how to do it?
3
votes
1answer
434 views

mosquitto bruteforce fail2ban failregex

I am trying to write fail2ban filter to block bruteforcing IP addresses which are trying to subscribe to username/password protected mosquitto service by guessing username/password combinations. On ...
3
votes
1answer
790 views

fail2ban with iptables-persistent

I've been running fail2ban for a bit, and recently installed iptables-persistent and am using it with ipset for a blacklist (there's one particular IP that is always hammering away at this machine). ...
0
votes
1answer
163 views

Can't install fail2ban on CentOS 6.9

I can't install fail2ban on my CentOS 6.9. Here is my config # cat /etc/*release CentOS release 6.9 (Final) CentOS release 6.9 (Final) CentOS release 6.9 (Final) # rpm -q epel-release epel-release-...
0
votes
1answer
410 views

fail2ban fails 2 ban login attemps to smtp (postfix) server in docker container

I got a problem with my host / docker setting as follows: Host runs fail2ban, which accesses the mail.log files from the docker container, which are mapped over a volume. This all works fine, I ...
1
vote
1answer
131 views

fail2ban conf file

I'm running: Fail2Ban v0.9.6 on Debian 9.4 (4.9.0-6-amd64 #1 SMP Debian 4.9.88-1+deb9u1 (2018-05-07) x86_64 GNU/Linux) This is my F2B directory: $ la -al /etc/fail2ban total 72K drwxr-xr-x 6 ...
0
votes
1answer
187 views

Run fail2ban-regex by piping with zcat?

Normally running the command would go like this: $ fail2ban-regex /var/log/ningx/access.log \ /etc/fail2ban/filter.d/nginx-noscript.conf -v However, I have multiple files that I'd like to parse ...
5
votes
1answer
2k views

How does fail2ban protect against DDoS?

How does fail2ban protect against SSH DDoS attacks? What does it do in the case of a DDoS attack? And how does it determine if it is a DDoS? I am asking only about DDoS attacks. (I assume it really ...
0
votes
2answers
755 views

Can't list any iptables rules with iptables -Lvn

I just installed fail2ban and when I wanted to check if ssh iptables jail is running. That is when I saw that iptables -Lvn list nothing. Iptables are running with custom script but I have no idea why ...
2
votes
3answers
2k views

fail2ban keeps saying already banned but it didn't actually ban

I just configured a new server and installed fail2ban as well, but it is not banning me when I keep trying to connect with the wrong password fail2ban.log: 2018-03-23 12:46:29,363 fail2ban.actions ...
0
votes
2answers
1k views

Fedora, Fail2ban : Fail2ban wont show up in iptables -L

I have Fedora installed on one our servers and installed fail2ban on it. in jail.conf, I have added the below text, but iptables -L still wont show the fail2ban-ssh. Am I missing something? Thank you. ...
0
votes
1answer
198 views

How can I get fail2ban to install on Centos 7.4?

I've done yum install epel-release and this shows in my repolist: repo id repo name ...
0
votes
1answer
442 views

Block all IPs for SSH/SSHD with iptables/fail2ban or firewalld?

I'm trying to learn Linux and get familiar with it. How do I block all IPs except two certain IPs on different subnets for SSH/SSHD? I've been trying to Google for an answer but nothing seem to work ...
0
votes
1answer
525 views

Fail2ban logging to systemd

I am trying to set the fail2ban's backend to systemd. File: /etc/fail2ban/jail.local Option: backend = systemd And it won't start, logs: 2018-06-27 12:09:53,387 fail2ban.jail [10240]: ...
1
vote
1answer
73 views

Why are there both printf and print in this command?

While studying about fail2ban I came across this command. I never worked with awk before, only with sed. I don't understand why there are both printf and print, there: awk '{ printf "# "; print; }' /...
6
votes
2answers
4k views

creating an alternate jail in fail2ban for manual banning

I have a fail2ban instance that works well. But I also like to occasionally examine the logs manually and try to ID system probes that are working around my standard f2b definitions. What I'm ...
0
votes
2answers
2k views

dpkg: error processing package fail2ban (--configure):

I am trying to install fail2ban service on my ubuntu server 16.04, but i have this error and fail2ban service cannot start, what's the problem? root@clm:~# apt install fail2ban Reading package lists.....
0
votes
1answer
271 views

Fail2ban is started but am not seeing any activity on journalctl

I installed fail2ban, created .local versions of the supplied config files and started the service. The service is started as below. However I see no entries whatsoever in journalctl. How do I know it ...
0
votes
2answers
1k views

fail2ban:11 lines must begin with a keyword or a filename (possibly in double quotes)

I am rotating the logs of my Fail2Ban service on a daily basis, but, I keep getting this error on a daily basis: /etc/cron.daily/logrotate: error: fail2ban:11 lines must begin with a keyword or a ...
-1
votes
1answer
829 views

fail2ban not blocking right away

I set up a fail2ban system on my server to restrict SSH access. It works fine, except that after entering the username on the unit, if I enter the password incorrect 3 times (my maxretry value), it ...