Questions tagged [fail2ban]
anti-bruteforcing daemon that works on connection attempts to services such as SSH
107
questions
0
votes
0answers
15 views
Fail2ban multiple actions
I am trying to create a jail for fail2ban, where upon a regex match I want to block the source IP from reaching either port 80 or 443 on my server.
I've tried variations of this:
action = iptables[...
0
votes
0answers
73 views
Can't find where to enabled Fail2Ban Features - Ubuntu
I followed a site to install and configure Fail2Ban
apt-get update && apt-get upgrade -y
apt-get install fail2ban
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
cat jail.local
I ...
1
vote
1answer
36 views
What should I check when I can't SSH into my box?
I update my :
/etc/ssh/sshd_config, update port from 22 to 558
/etc/fail2ban/jail.local, update port from 22 to 558
add a new record in iptables
iptables -A INPUT -p tcp -m multiport --dports 558 -...
2
votes
0answers
370 views
Fail2ban & nftables errors, IPs not banned
So I've been experimenting with nftables in CentOS 8 and things are going pretty well, but I'm having a weird problem with fail2ban.
Fail2ban cannot ban IPs with nftables-multiport or nftables-...
0
votes
1answer
66 views
How can I hide failed ssh attempts for users that don't exist?
The Question
How can I exclude inconsequential¹ failed SSH logins?
Background
For ambient awareness, I like to have little background windows showing system error logs on every GNU/Linux box I ...
0
votes
1answer
15 views
How to configure fail2ban without a log file?
I am trying to configure a policy in fail2ban - the detection and identity of bad behaviour is rather complex in my case, so I was planning to handle this in a dedicated program. Rather than having ...
2
votes
1answer
200 views
fail2ban applying ban but is not blocking the connection
I have a fail2ban setup enabled for sshd on CentOS. It is reading the logs fine. Doing some testing with SSH failed logins from a remote server:
Nov 23 20:51:52 new fail2ban.filter[29090]: INFO [sshd]...
0
votes
0answers
47 views
Fail2ban not reading zimbra.log file from Zimbra Collaboration Suite 8.8.7 inside a docker
We use Zimbra Collaboration Suite 8.8.7 here inside a docker container. Zimbra is logging at /var/log/zimbra.log. Outside docker this file is at /zpool/zimbra/opt/log/zimbra.log.
tail -f /zpool/...
4
votes
0answers
49 views
Large fail2ban database, normal?
The fail2ban database on my server is quite large (420MB).
The fail2ban log is quite busy (there is a "filter" entry every two seconds) but iptables shows only a few banned addresses.
dbpurgeage is ...
0
votes
0answers
26 views
Fail2Ban does not want to run
I have this error when i lauchn Fail2Ban Service:
systemctl status fail2ban.service
● fail2ban.service - Fail2Ban Service
Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; enabled; vendor ...
0
votes
1answer
37 views
Can't Start Fail2Ban
Lately I got 3 emails from Fail2Ban
The jail nginx-http-auth has been stopped.
The jail nginx-badbots has been stopped.
The jail ssh has been stopped.
Then I start SSH into my VM, this is the log
...
-2
votes
1answer
24 views
Fail2ban adding new chain
how to create a new chain that appear in first position (before recidive) that create iptables rules to block an entire IP class if recidive has N IP's of that block?
thx in advance
0
votes
1answer
45 views
Bulk login attempts on port 22 shutdown our SSH git server access, HTTPs still works though
Recently we have been seeing a lot of connections from IPs in to our public git server. When this happens, our devs are unable to commit via SSH as the server is very, very slow and I am unable to ...
0
votes
0answers
472 views
Failed use Fail2ban: No file(s) found for glob /var/log/audit/audit.log
I'm tring use a Fail2ban on Raspbian follow this tutorial, but it didn't work, and appear this error:
root@raspberrypi:~# fail2ban-server
No file(s) found for glob /var/log/audit/audit.log
Failed ...
0
votes
1answer
31 views
Changed ssh port to 1234, can't connect to server, fail2ban in use
I just changed my ssh port to 1234 and now i cant access my server any more.
Also I set AllowUsers stephan in /etc/ssh/sshd_config
I have fail2ban installed and i am trying to login as root user. ...
0
votes
0answers
18 views
Strange ban when attempting to make request on a server
I am currently getting banned, every time I try to make a REST request onto an Elasticsearch server hosted inside a LXC container. The host of LXC containers is a Debian Stretch.
The Ban is not only ...
0
votes
2answers
107 views
REGEX: flush a number of related chains in iptables
I want to flush a number of related chains in IPtables. Their names like 'f2b.*'
I want the entire chain gone!
e.g. all this gone.
-A f2b-postfix-sasl -s 103.231.139.130/32 -j REJECT --reject-with ...
1
vote
0answers
108 views
fail2ban not detecting ssh failures on CentOS 7
I've installed fail2ban on CentOS 7 and added jail.local:
[sshd]
enabled = true
When I try a bad ssh login, I get a log entry in /var/log/secure like this:
Jun 5 11:09:40 arsenal sshd[32595]: ...
0
votes
0answers
119 views
fail2ban not blocking access to imap ports
I have a mail server with dovecot. I run fail2ban on it, with the jail [dovecot] enabled. Here is the status of that jail.
# fail2ban-client status dovecot
Status for the jail: dovecot
|- Filter
| |...
3
votes
2answers
867 views
How to show “number of failed login attempts” on a successful ssh login?
I use CentOS 7 on a host. There used to be a report of the number of failed login attempts shown whenever I logged into the machine using SSH. The full banner was something like this:
Last failed ...
0
votes
1answer
66 views
iptables Performance with long chains
I'd like to know if long chains in iptables is likely to cause a performance issue. Here a long chain might be >2,500 individual IP bans.
My concern is that my limited knowledge of iptables suggests ...
4
votes
0answers
141 views
fail2ban too slow, banning after the attack
We had a "register"-attack to our voip server (freeswitch).
In the Logs it looks something like this:
2019-04-25 14:35:16.137965 [WARNING] sofia_reg.c:1743 SIP auth failure (REGISTER) on sofia ...
0
votes
1answer
30 views
UFW Syntax to find and delete ONE rule among 4279 UFW REJECT IN rules
I've setup Fail2Ban to use UFW actions to permanently ban IPs after 1 failed attempt. What seemed like a good idea are now causing me problems as I need to remove one IP among all those ufw rules.
...
3
votes
0answers
101 views
Why fail2ban would ban an IP that is whitelisted (on ignoreip)?
I have fail2ban configured to protect the authentication on a postfix service.
The jail is working properly on the ban side, but the ignoreip option seems to be ignored or misconfigured since it bans ...
0
votes
1answer
111 views
Fail2ban regex: how to NOT get host name but ip?
In my access.log I got somerow a
ip - - [date] method link ... etc..
and some others with
www.domain.com:ip - - [date] method link ... etc..
I am actually using this regexp
^<HOST>.*/...
1
vote
1answer
411 views
fail2ban has banned my Ip but I can still login using SSH
I done a fresh new install of fail2ban on a Debian 9.8
I copied /etc/fail2ban/jail.conf as jail.local.
And in my jail.local in added enabled=true under [ssh]
Tailing fail2ban's log I can see what ...
1
vote
1answer
678 views
Docker between-container iptables and fail2ban?
Say I have a public-facing Nginx reverse proxy container (A) that sends traffic to a downstream web service (B). This A container is where TLS connections terminate. The Docker server is also behind ...
2
votes
1answer
132 views
fail2ban will not ban again after first one expires
I couldn't make fail2ban to block IP address coming up in postfix log on Debian 9. I rewrote the failregex to be like this:
NOQUEUE: reject: RCPT from (.*)\[<HOST>\]:(.*) 550 5.7.1 Service ...
0
votes
0answers
478 views
Why does fail2ban not trigger my custom filter?
fail2ban-regex verified that my filter matches Jan 14 07:39:41 myhost01 sshd[26433]: Connection closed by authenticating user root 127.0.0.1 port 56216 [preauth] 68 times inside auth.log, but fail2ban-...
3
votes
1answer
3k views
How to automatically permanently ban IP addresses?
Currently I have been using iptables on a new Debian server running Asterisk.
Every day I have been checking auth.log for IP addresses and manually doing iptables -A INPUT -s IPA.DRE.SS.0/24 -j DROP
...
0
votes
1answer
96 views
Fail2ban Debian 9, freeswitch
My server goes crazy with the CPU when I reload fail2ban and sometimes mid day as well the CPU goes very high.
I remember a while ago I was told to switch to systemd, any idea on how to do it?
3
votes
1answer
434 views
mosquitto bruteforce fail2ban failregex
I am trying to write fail2ban filter to block bruteforcing IP addresses which are trying to subscribe to username/password protected mosquitto service by guessing username/password combinations.
On ...
3
votes
1answer
790 views
fail2ban with iptables-persistent
I've been running fail2ban for a bit, and recently installed iptables-persistent and am using it with ipset for a blacklist (there's one particular IP that is always hammering away at this machine). ...
0
votes
1answer
163 views
Can't install fail2ban on CentOS 6.9
I can't install fail2ban on my CentOS 6.9. Here is my config
# cat /etc/*release
CentOS release 6.9 (Final)
CentOS release 6.9 (Final)
CentOS release 6.9 (Final)
# rpm -q epel-release
epel-release-...
0
votes
1answer
410 views
fail2ban fails 2 ban login attemps to smtp (postfix) server in docker container
I got a problem with my host / docker setting as follows:
Host runs fail2ban, which accesses the mail.log files from the docker container, which are mapped over a volume. This all works fine, I ...
1
vote
1answer
131 views
fail2ban conf file
I'm running:
Fail2Ban v0.9.6
on Debian 9.4 (4.9.0-6-amd64 #1 SMP Debian 4.9.88-1+deb9u1 (2018-05-07) x86_64 GNU/Linux)
This is my F2B directory:
$ la -al /etc/fail2ban
total 72K
drwxr-xr-x 6 ...
0
votes
1answer
187 views
Run fail2ban-regex by piping with zcat?
Normally running the command would go like this:
$ fail2ban-regex /var/log/ningx/access.log \
/etc/fail2ban/filter.d/nginx-noscript.conf -v
However, I have multiple files that I'd like to parse ...
5
votes
1answer
2k views
How does fail2ban protect against DDoS?
How does fail2ban protect against SSH DDoS attacks? What does it do in the case of a DDoS attack? And how does it determine if it is a DDoS?
I am asking only about DDoS attacks.
(I assume it really ...
0
votes
2answers
755 views
Can't list any iptables rules with iptables -Lvn
I just installed fail2ban and when I wanted to check if ssh iptables jail is running. That is when I saw that iptables -Lvn list nothing. Iptables are running with custom script but I have no idea why ...
2
votes
3answers
2k views
fail2ban keeps saying already banned but it didn't actually ban
I just configured a new server and installed fail2ban as well, but it is not banning me when I keep trying to connect with the wrong password
fail2ban.log:
2018-03-23 12:46:29,363 fail2ban.actions ...
0
votes
2answers
1k views
Fedora, Fail2ban : Fail2ban wont show up in iptables -L
I have Fedora installed on one our servers and installed fail2ban on it. in jail.conf, I have added the below text, but iptables -L still wont show the fail2ban-ssh. Am I missing something? Thank you. ...
0
votes
1answer
198 views
How can I get fail2ban to install on Centos 7.4?
I've done yum install epel-release and this shows in my repolist:
repo id repo name ...
0
votes
1answer
442 views
Block all IPs for SSH/SSHD with iptables/fail2ban or firewalld?
I'm trying to learn Linux and get familiar with it. How do I block all IPs except two certain IPs on different subnets for SSH/SSHD? I've been trying to Google for an answer but nothing seem to work ...
0
votes
1answer
525 views
Fail2ban logging to systemd
I am trying to set the fail2ban's backend to systemd.
File:
/etc/fail2ban/jail.local
Option:
backend = systemd
And it won't start, logs:
2018-06-27 12:09:53,387 fail2ban.jail [10240]: ...
1
vote
1answer
73 views
Why are there both printf and print in this command?
While studying about fail2ban I came across this command. I never worked with awk before, only with sed. I don't understand why there are both printf and print, there:
awk '{ printf "# "; print; }' /...
6
votes
2answers
4k views
creating an alternate jail in fail2ban for manual banning
I have a fail2ban instance that works well.
But I also like to occasionally examine the logs manually and try to ID system probes that are working around my standard f2b definitions.
What I'm ...
0
votes
2answers
2k views
dpkg: error processing package fail2ban (--configure):
I am trying to install fail2ban service on my ubuntu server 16.04, but i have this error and fail2ban service cannot start, what's the problem?
root@clm:~# apt install fail2ban
Reading package lists.....
0
votes
1answer
271 views
Fail2ban is started but am not seeing any activity on journalctl
I installed fail2ban, created .local versions of the supplied config files and started the service. The service is started as below. However I see no entries whatsoever in journalctl. How do I know it ...
0
votes
2answers
1k views
fail2ban:11 lines must begin with a keyword or a filename (possibly in double quotes)
I am rotating the logs of my Fail2Ban service on a daily basis, but, I keep getting this error on a daily basis:
/etc/cron.daily/logrotate:
error: fail2ban:11 lines must begin with a keyword or a ...
-1
votes
1answer
829 views
fail2ban not blocking right away
I set up a fail2ban system on my server to restrict SSH access. It works fine, except that after entering the username on the unit, if I enter the password incorrect 3 times (my maxretry value), it ...
