Questions tagged [fail2ban]
anti-bruteforcing daemon that works on connection attempts to services such as SSH
0
votes
0answers
2 views
iptables Performance with long chains
I'd like to know if long chains in iptables is likely to cause a performance issue. Here a long chain might be >2,500 individual IP bans.
My concern is that my limited knowledge of iptables suggests ...
4
votes
0answers
28 views
fail2ban too slow, banning after the attack
We had a "register"-attack to our voip server (freeswitch).
In the Logs it looks something like this:
2019-04-25 14:35:16.137965 [WARNING] sofia_reg.c:1743 SIP auth failure (REGISTER) on sofia ...
0
votes
1answer
16 views
UFW Syntax to find and delete ONE rule among 4279 UFW REJECT IN rules
I've setup Fail2Ban to use UFW actions to permanently ban IPs after 1 failed attempt. What seemed like a good idea are now causing me problems as I need to remove one IP among all those ufw rules.
...
3
votes
0answers
30 views
Why fail2ban would ban an IP that is whitelisted (on ignoreip)?
I have fail2ban configured to protect the authentication on a postfix service.
The jail is working properly on the ban side, but the ignoreip option seems to be ignored or misconfigured since it bans ...
0
votes
1answer
27 views
Fail2ban regex: how to NOT get host name but ip?
In my access.log I got somerow a
ip - - [date] method link ... etc..
and some others with
www.domain.com:ip - - [date] method link ... etc..
I am actually using this regexp
^<HOST>.*/...
1
vote
1answer
33 views
fail2ban has banned my Ip but I can still login using SSH
I done a fresh new install of fail2ban on a Debian 9.8
I copied /etc/fail2ban/jail.conf as jail.local.
And in my jail.local in added enabled=true under [ssh]
Tailing fail2ban's log I can see what ...
0
votes
0answers
55 views
Docker between-container iptables and fail2ban?
Say I have a public-facing Nginx reverse proxy container (A) that sends traffic to a downstream web service (B). This A container is where TLS connections terminate. The Docker server is also behind ...
1
vote
1answer
44 views
fail2ban will not ban again after first one expires
I couldn't make fail2ban to block IP address coming up in postfix log on Debian 9. I rewrote the failregex to be like this:
NOQUEUE: reject: RCPT from (.*)\[<HOST>\]:(.*) 550 5.7.1 Service ...
0
votes
0answers
101 views
Why does fail2ban not trigger my custom filter?
fail2ban-regex verified that my filter matches Jan 14 07:39:41 myhost01 sshd[26433]: Connection closed by authenticating user root 127.0.0.1 port 56216 [preauth] 68 times inside auth.log, but fail2ban-...
3
votes
1answer
569 views
How to automatically permanently ban IP addresses?
Currently I have been using iptables on a new Debian server running Asterisk.
Every day I have been checking auth.log for IP addresses and manually doing iptables -A INPUT -s IPA.DRE.SS.0/24 -j DROP
...
0
votes
1answer
40 views
Fail2ban Debian 9, freeswitch
My server goes crazy with the CPU when I reload fail2ban and sometimes mid day as well the CPU goes very high.
I remember a while ago I was told to switch to systemd, any idea on how to do it?
2
votes
1answer
103 views
mosquitto bruteforce fail2ban failregex
I am trying to write fail2ban filter to block bruteforcing IP addresses which are trying to subscribe to username/password protected mosquitto service by guessing username/password combinations.
On ...
1
vote
1answer
251 views
fail2ban with iptables-persistent
I've been running fail2ban for a bit, and recently installed iptables-persistent and am using it with ipset for a blacklist (there's one particular IP that is always hammering away at this machine). ...
0
votes
1answer
98 views
Can't install fail2ban on CentOS 6.9
I can't install fail2ban on my CentOS 6.9. Here is my config
# cat /etc/*release
CentOS release 6.9 (Final)
CentOS release 6.9 (Final)
CentOS release 6.9 (Final)
# rpm -q epel-release
epel-release-...
0
votes
1answer
222 views
fail2ban fails 2 ban login attemps to smtp (postfix) server in docker container
I got a problem with my host / docker setting as follows:
Host runs fail2ban, which accesses the mail.log files from the docker container, which are mapped over a volume. This all works fine, I ...
1
vote
1answer
80 views
fail2ban conf file
I'm running:
Fail2Ban v0.9.6
on Debian 9.4 (4.9.0-6-amd64 #1 SMP Debian 4.9.88-1+deb9u1 (2018-05-07) x86_64 GNU/Linux)
This is my F2B directory:
$ la -al /etc/fail2ban
total 72K
drwxr-xr-x 6 ...
0
votes
1answer
106 views
Run fail2ban-regex by piping with zcat?
Normally running the command would go like this:
$ fail2ban-regex /var/log/ningx/access.log \
/etc/fail2ban/filter.d/nginx-noscript.conf -v
However, I have multiple files that I'd like to parse ...
4
votes
1answer
689 views
How does fail2ban protect against DDoS?
How does fail2ban protect against SSH DDoS attacks? What does it do in the case of a DDoS attack? And how does it determine if it is a DDoS?
I am asking only about DDoS attacks.
(I assume it really ...
0
votes
2answers
382 views
Can't list any iptables rules with iptables -Lvn
I just installed fail2ban and when I wanted to check if ssh iptables jail is running. That is when I saw that iptables -Lvn list nothing. Iptables are running with custom script but I have no idea why ...
0
votes
2answers
794 views
fail2ban keeps saying already banned but it didnt actually ban
He!
I just configured a new server and installed fail2ban aswell but it is not banning me when I keep trying to connect with the wrong password
fail2ban.log:
2018-03-23 12:46:29,363 fail2ban....
0
votes
2answers
580 views
Fedora, Fail2ban : Fail2ban wont show up in iptables -L
I have Fedora installed on one our servers and installed fail2ban on it. in jail.conf, I have added the below text, but iptables -L still wont show the fail2ban-ssh. Am I missing something? Thank you. ...
0
votes
1answer
154 views
How can I get fail2ban to install on Centos 7.4?
I've done yum install epel-release and this shows in my repolist:
repo id repo name ...
0
votes
1answer
213 views
Block all IPs for SSH/SSHD with iptables/fail2ban or firewalld?
I'm trying to learn Linux and get familiar with it. How do I block all IPs except two certain IPs on different subnets for SSH/SSHD? I've been trying to Google for an answer but nothing seem to work ...
0
votes
1answer
341 views
Fail2ban logging to systemd
I am trying to set the fail2ban's backend to systemd.
File:
/etc/fail2ban/jail.local
Option:
backend = systemd
And it won't start, logs:
2018-06-27 12:09:53,387 fail2ban.jail [10240]: ...
1
vote
1answer
70 views
Why are there both printf and print in this command?
While studying about fail2ban I came across this command. I never worked with awk before, only with sed. I don't understand why there are both printf and print, there:
awk '{ printf "# "; print; }' /...
4
votes
2answers
2k views
creating an alternate jail in fail2ban for manual banning
I have a fail2ban instance that works well.
But I also like to occasionally examine the logs manually and try to ID system probes that are working around my standard f2b definitions.
What I'm ...
0
votes
2answers
1k views
dpkg: error processing package fail2ban (--configure):
I am trying to install fail2ban service on my ubuntu server 16.04, but i have this error and fail2ban service cannot start, what's the problem?
root@clm:~# apt install fail2ban
Reading package lists.....
0
votes
1answer
192 views
Fail2ban is started but am not seeing any activity on journalctl
I installed fail2ban, created .local versions of the supplied config files and started the service. The service is started as below. However I see no entries whatsoever in journalctl. How do I know it ...
0
votes
2answers
767 views
fail2ban:11 lines must begin with a keyword or a filename (possibly in double quotes)
I am rotating the logs of my Fail2Ban service on a daily basis, but, I keep getting this error on a daily basis:
/etc/cron.daily/logrotate:
error: fail2ban:11 lines must begin with a keyword or a ...
-1
votes
1answer
544 views
fail2ban not blocking right away
I set up a fail2ban system on my server to restrict SSH access. It works fine, except that after entering the username on the unit, if I enter the password incorrect 3 times (my maxretry value), it ...
0
votes
1answer
135 views
Fail2Ban not picking up dropbear auth failures - again
RASPBIAN Jessie
Edit: It is working from some clients
From another Rasberry Pi the log is working and now picking up the proper entry in the log
Jul 22 04:02:21 <HOSTNAME> dropbear[2462]: Bad ...
0
votes
1answer
285 views
Fail2Ban not picking up dropbear auth failures
raspbian
Linux [hostname] 4.9.36+ #1015 Thu Jul 6 16:07:57 BST 2017 armv6l GNU/Linux
fail2ban is not picking up the dropbear auth failures. This was working for openssh without issues. I went to ...
0
votes
1answer
794 views
Fail2Ban with DDWRT or router
How can I use fail2ban with DDWRT or a router?
I love using fail2ban, but there is no info about using fail2ban in a linux base ddwrt / optware / entware and so on.
1
vote
1answer
1k views
Fail2Ban fails to start on CentOS 7
I'm running CentOS 7, all fully updated, and am trying to get Fail2Ban to work, but I'm running into problems.
Specifically, I'm trying to block brute force SSH attacks. I'm pretty sure I've set up ...
2
votes
0answers
748 views
Fail2Ban fails to ban!
I get a lot of IPs that try probing my sites so I set up a filter to ban them after a few 404 errors.
But something is not working because I get a bunch of these instead:
2017-06-07 01:08:37,175 ...
1
vote
1answer
544 views
Fail2Ban custom filter not applied
I tried to create a custom jail rule in fail2ban, but it never gets applied.
I did not find such an official documentation, I might miss something.
/etc/fail2ban/filter.d/expressjs.conf
[...
2
votes
1answer
315 views
Does it exist a fail2ban alternative in official Centos repository?
If I don't want to add other repository (EPEL for example) than the official ones that are coming with a fresh CentOS install, is there a more official alternative than fail2ban?
1
vote
0answers
185 views
Fail2ban: cannot change default chain
OK: so I have fail2ban installed on a Debian 8.7 machine: I have a iptables that looks like this:
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N fail2ban-ssh-daily
-N fail2ban-ssh-permaban
-...
1
vote
1answer
598 views
How do I force vsftpd to log the numeric IP address on connection attempts?
Scanning through my log files, I see repeated unauthorized attempts to log in to my FTP server. The system uses rDNS to give me a hostname of the remote user, and if rDNS gives an answer — even a ...
1
vote
3answers
1k views
Restore original fail2ban configuration on CentOS 7
I installed fail2ban from EPEL using yum install, and then proceeded to screw up the configuration after forgetting to back up /etc/fail2ban.
Now I want the original configuration back.
First I ...
2
votes
2answers
6k views
fail2ban is running but no fail2ban.log log file exists for it
I've set up fail2ban on a centos VPS used for a few mail accounts among other things and want to check that everything is running smoothly. According to fail2ban-client status everything is running as ...
4
votes
1answer
2k views
Why does Fail2ban not send mail for one particular jail?
Fail2ban is doing it's job and fail2ban-client status is showing me they're all working fine and offending addresses get blocked.
When an address is blocked I like to receive a mail. That's working ...
0
votes
2answers
164 views
Debian linux systemd shutdown, have shorewall service wait for fail2ban service
Running Debian unstable with shorewall for the firewall and fail2ban. Was getting "shorewall not running errors" upon boot up in the fail2ban log, but that was fixed with
After=network.target
in /...
0
votes
1answer
969 views
Adding iptables rules after implementing fail2ban
I recently implemented fail2ban on a fresh debian server which left me with some default iptables configuration automatically,
root@plutarchy:/etc/apache2# iptables -S
-P INPUT ACCEPT
-P FORWARD ...
0
votes
1answer
211 views
Fail2ban Jail List
Recently our website starting loading extremely slow when browsing publicly to FDQN. Using IP of the website it will load the main file, but not dependencies. Curl show the TCP exchange happen in a ...
0
votes
1answer
471 views
Lock down squid proxy to specific IP addresses
I have an anonymous squid proxy server running and I would like it to drop requests from any non-approved IP.
I've limited access already via acl's in the squid config. However, if someone tries to ...
1
vote
0answers
117 views
Losing ssh connection
I have a CentOS server where I try running fail2ban & iptables (don't like firewalld so I installed the package "iptables-services").
Using iptables with the following rules in a script "/etc/...
0
votes
1answer
512 views
Change the chain name from fail2ban
How can I change the name of the chain that fail2ban has created.
root@host:~# iptables -L INPUT -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
fail2ban-dotcom ...
3
votes
0answers
483 views
Nagios - Help with getting NRPE to work with check_fail2ban.sh
I am trying to monitor fail2ban with Nagios so, I found the following check via a Google search:
http://nagios.fm4dd.com/plugins/manual/check_fail2ban.htm
I am trying to get the check to work on a ...
1
vote
1answer
2k views
Block ESTABLISHED connections with firewalld/iptables
I am running firewalld on my server and I am trying to setup a fail2ban (using firewalld) in order to improve security. The problem is: I can't get it to kill established connections.
Firewalld has ...
