Skip to main content

Questions tagged [fail2ban]

anti-bruteforcing daemon that works on connection attempts to services such as SSH

Filter by
Sorted by
Tagged with
0 votes
1 answer
45 views

Bot crawling getting 301/redirects instead of 404 so it's hiding from fail2ban. How is it getting 301 intead of 404?

I have fail2ban setup and it's working great for most scanning. It triggers off any 4xx in the nginx error log. However, note the following bot scan. Somehow THIS bot is triggering my server to return ...
Chris's user avatar
  • 103
0 votes
0 answers
187 views

Cannot start fail2ban on debian 12: Failed to initialize any backend for Jail 'sshd'

I cannot start fail2ban on a Debian 12 server. I get the following error: 2024-04-01 23:51:42,973 fail2ban [16176]: ERROR NOK: ("Failed to initialize any backend for Jail 'sshd'&...
giovi321's user avatar
  • 907
0 votes
0 answers
102 views

Fail2ban firewall-cmd ipset not blocking

Fail2ban has accumulated quite the list of ip's to block: # fail2ban-client banned [{'sshd': ['101.126.34.231', '106.58.179.182', '117.50.187.153', '119.91.54.127', '121.250.190.129', '124.220.15.172',...
azzid's user avatar
  • 1,000
0 votes
1 answer
134 views

Trying to understand why kernel attempts to authenticate a banned IP (Debian 10 VPS)

I have a Debian 10 server running on a VPS. The only software I installed are: tinyproxy (http proxy) and fail2ban I have included: the results of port scan using nmap my specific settings in the ...
xstack's user avatar
  • 105
0 votes
0 answers
62 views

How to disable creation of fooX lists in IPSet

I installed fail2ban, ipset and shorewall on Debian 12 to protect my server from bruteforce. After changing the rules and restart shorewall, fooX**** sheets are created in ipset. Also i see this ...
Meloman_ze's user avatar
0 votes
0 answers
92 views

How to ban IPs at gateway with fail2ban on multiple backend servers?

I have configured fail2ban successfully on multiple backend servers on my network and it's all ok -- except that I would like a ban originating from eg email to be banned not just for email but all ...
Ruth Ivimey-Cook's user avatar
2 votes
1 answer
169 views

Fail2ban does not start actionban even though the filter works

I'm trying to filter out malicious requests to our website on our AWS Instances through adding and removing IPs in the WAF IP sets. I'm trying to set up fail2ban to help with this. These are the files ...
Karov's user avatar
  • 113
1 vote
1 answer
446 views

fail2ban block webrequests containing a given string

I want to configure my system to reject all web requests that contain inappropriate words (I won't be using the actual string here, but an example string that is representative of the implementation ...
MaxBrandtner's user avatar
1 vote
1 answer
360 views

Unix Command (and bash alias) or script to band/unban IP addresses in Fail2ban without having to lookup and specify "jail name"

I am creating a bash alias (or possibly a script) to ban and unban IP addresses with fail2ban on Ubuntu 20.04. The bash syntax I am using to unban IP address is: fail2ban-client set YOURJAILNAMEHERE ...
DanRan's user avatar
  • 113
2 votes
2 answers
2k views

fail2ban SSH jail change action REJECT to DROP

I am trying to configure a simple SSH jail with fail2ban. Below is the configuration of the jail in /etc/fail2ban/jail.conf : [sshd] # To use more aggressive sshd modes set filter parameter "...
PizzaYolo's user avatar
1 vote
2 answers
271 views

fail2ban action ipset retry or timeout

Recently in an Ubuntu 20.04 box from fail2ban I got the following error: 2023-07-13 06:57:05,129 fail2ban.actions [3063]: NOTICE [nginx-http-auth] Ban 2600:1005:b02d:3b6a:c1e:4a7e:6a9f:ccc4 ...
Javier López's user avatar
0 votes
1 answer
566 views

Is there a special set of permissions that must be set on a log file read by fail2ban?

I've experienced some spam recently on my Minecraft server that I suspect to be from some kind of port-scanner or other bot. So far whatever it is hasn't posed any real threat but I figured better ...
kawub's user avatar
  • 11
1 vote
0 answers
377 views

nftables priority conflict with fail2ban

I'm new to nftables and I haven't used fail2ban before so its possible I'm wrong, but I think I may have discovered a bug in fail2ban. I had constructed a set of firewall rules using nftables which ...
rick mallett's user avatar
2 votes
1 answer
252 views

fail2ban keeps saying that the IP is banned and then it says it is already banned

Here is my fail2ban version v0.11.1 set up on a Ubuntu Linux 20.04 on an AWS EC2 planform. The jail.local file has the standard defaults from jail.conf but I only activate these 2 jails in jail....
Jack Stein's user avatar
0 votes
0 answers
99 views

"ssh connect to host x port y: No route to host" after reboot when fail2ban is active on a different port than 22

I have this error when I install fail2ban on my server and when the ssh port is different from 22. It's an almalinux distribution. I already set semanage port -a -t ssh_port_t -p tcp {{ var_ssh_port }}...
user avatar
2 votes
0 answers
130 views

block incoming request providing a fake ssh certificate, would that be enough?

I'd like to automatically block the IPs of requests that are providing a fake ssh certificate or key ssh_dispatch_run_fatal: Connection from XX.XXX.XXX.XX port XXXXX: Connection corrupted [preauth] ...
mario ruiz's user avatar
1 vote
2 answers
369 views

Fail2Ban is bannig IPs but they can still attack me what am I doing wrong?

I'm right now building my first Linux Server using Fedora 36. I activated ssh and realized that bots are trying to connect to my server. After a bit of research, I found fail2ban and installed it. It ...
Raistlin's user avatar
0 votes
1 answer
1k views

Postfix not logging authentication failures

I have a postfix server running on Ubuntu 18.04lts with authentication enabled. (from main.cf) smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination ...
symcbean's user avatar
  • 5,831
1 vote
2 answers
1k views

Iptables and fail2ban on Yocto Linux

I've installed both iptables and fail2ban on my embedded Yocto-Linux. When fail2ban set the following command: iptables -w -I INPUT -p tcp -m multiport --dports http,https -j f2b-NoScript I have that ...
simone tolotti's user avatar
1 vote
1 answer
164 views

How do I start Ubuntu's ufw before fail2ban to solve a loss of connectivity issue?

My skill level configuring systemd is more of a newbie and need help as I've now hit a road block and I'm stuck. I have fail2ban and ufw installed on a Raspberry Pi clone board. The problem I've ...
Myron's user avatar
  • 33
0 votes
1 answer
248 views

My custom fail2ban jail fails to load even though fail2ban-regex suggests that it should work?

I've written a custom jail and filter in fail2ban for logging into my service. The log file is located in /var/log/motion/motion.log and a failed login generates a line like this: [0:ml1] [ALR] [STR] [...
KacperNoe's user avatar
0 votes
1 answer
529 views

VNC too many authentication failures error - Fail2ban

On a Debian 11 server with Xtightvnc, I am getting a lot of "too many authentication failures" messages. I would like to put fail2ban to block unauthorized users who try to login into my ...
Nebenzahl's user avatar
  • 125
0 votes
1 answer
682 views

fail2ban: how to customize filters and based on time-occurs?

I have an application, and seems it was attacked by huge ips. log file: /root/kitty/nohup.out process: kitty port: 8888 [2021-08-31 10:02:20] [ALL] 168.138.142.22:50384 incoming connection [2021-08-...
Siwei's user avatar
  • 101
3 votes
2 answers
2k views

Fail2ban Regex help for banning sshd connection attempts

This is a tricky questions (for me) I'm trying to setup fail2ban to BAN all connection attempts to my ssh server that don't login. Now, my issue is.. everything, in the file filter.d/sshd.conf. for me ...
JoBe's user avatar
  • 397
0 votes
1 answer
859 views

fail2ban / FirewallD error: invalid port/service `1-65535' specified

I am running a CentOS 8.4 server. When I do a systemctl status firewalld I see the daemon is active and running, but I see the following error repeated five times: ERROR: '/usr/sbin/iptables-restore -...
location's user avatar
1 vote
0 answers
506 views

Fail2ban actionban with cURL

My Ubuntu server mail is working. I verified with this command below. echo "Mail is working on this server." | mail -s subject <[email protected]> In my entire jail.local ex. intruder ...
code-8's user avatar
  • 452
0 votes
1 answer
2k views

How can I use fail2ban with ipv6?

I have used the Fail2ban for a long time. I think this script is not able to manage the IPv6 -- or maybe it is working with IPv6? How can I prevent IPv6 attacks with Fail2ban or do I have to search ...
Róbert Kalmár's user avatar
0 votes
1 answer
2k views

Writing a fail2ban multiline regex

I'm not sure if this the correct regex, but i'm trying to add multiple lines at the ignoreregex Here are the config lines in my ddos.conf: [Definition] failregex = ^<HOST> -.*"(GET|POST).* ...
Dr Jay's user avatar
  • 151
2 votes
2 answers
887 views

fail2ban and iptables rules flood (resulting in poor bandwidth)

I've noticed this pattern happening a few times on my server in the last 6 months: First, fail2ban detects many SSH attempts from bots, and sucessfully bans them. Indeed in /etc/fail2ban/jail.conf I ...
Basj's user avatar
  • 2,559
1 vote
0 answers
714 views

Blocking FTP Brute Force Attack with Snort

I am trying to become familiar with Snort, and for this reason, I have set three VMs. A Kali, a windows machine with XAMPP and Ubuntu where I installed Snort. I believe I have Snort running in ...
george's user avatar
  • 11
3 votes
1 answer
5k views

fail2ban - have more than one regex in same filter file

I have the following in my fail2ban/filter.d/apache-scripts.conf file: [INCLUDES] before = botsearch-common.conf [Definition] failregex = (<HOST>).*(GET|HEAD|POST|PUT)\ \/(site\/|blog\/|old\/|...
ikwyl6's user avatar
  • 161
1 vote
1 answer
2k views

Fail2Ban Regex - NGNIX - Custom Regex

I am trying to create a custom log file for fail2ban NGNIX logs to catch a specific event. Regex is still relatively new to me so im trying to improve. This will be put into a custom filter but for ...
PInoob's user avatar
  • 33
1 vote
0 answers
3k views

fail2ban not banning ssh

Trying to setup fail2ban sshd on Ubuntu 20. # fail2ban-client status sshd Status for the jail: sshd |- Filter | |- Currently failed: 0 | |- Total failed: 0 | `- File list: /var/log/auth....
Maxim_united's user avatar
0 votes
1 answer
1k views

How to configure fail2ban file?

I installed fail2ban but When I enter fail2ban-client status in the Linux terminal, I get the following warnings: fail2ban.configreader [1616]: ERROR Found no accessible config files for 'filter.d/...
esmaeil's user avatar
2 votes
2 answers
709 views

Is fail2ban required if already using firewalld and restricting ssh

I have seen a lot of posts showing how to install fail2ban along with firewalld and wanted to know if fail2ban is really required for my set up. My set up is as follows Cent OS 8 in a VPS Public ...
itz_nsn's user avatar
  • 131
4 votes
1 answer
4k views

How can I enable/disable a jail using fail2ban?

We can add a line like this below a specific jail in the jail.local file, and control the jail: enabled = true/false But I think there should be a command to do this, as we've got bunch of "set&...
Aref Alikhani's user avatar
1 vote
1 answer
3k views

Server being attacked with key exchange attempts. Not being added to ban list by fail2ban

Looking through the sshd logs, there is a remote machine which appears to be attacking my server. here is an example of an entry. It is always the same IP. May 8 17:57:32 [removed] sshd[99267]: ...
user3728501's user avatar
0 votes
2 answers
2k views

How to prevent unban in fail2ban?

After configuring a port 22 forward from my router to my raspberry pi, I found that there were a TON of IPs trying to get in daily. I have tried to make my system more secure by setting up ufw and ...
Tian's user avatar
  • 105
3 votes
1 answer
28k views

SSH "kex_exchange_identification: read: Connection reset by peer"

The setup: Raspberry 3B running Raspbian Stretch 9 on an external HDD and using ZRAM Raspi used as a webserver running LAMP and MERN stacks and accessed remotely via SSH with 1 IDE (Coda for Mac OS) ...
PYG's user avatar
  • 171
4 votes
1 answer
4k views

Fail2ban multiple actions

I am trying to create a jail for fail2ban, where upon a regex match I want to block the source IP from reaching either port 80 or 443 on my server. I've tried variations of this: action = iptables[...
TSG's user avatar
  • 1,768
0 votes
1 answer
430 views

Can't find where to enabled Fail2Ban Features - Ubuntu

I followed a site to install and configure Fail2Ban apt-get update && apt-get upgrade -y apt-get install fail2ban cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local cat jail.local I ...
code-8's user avatar
  • 452
1 vote
1 answer
163 views

What should I check when I can't SSH into my box?

I update my : /etc/ssh/sshd_config, update port from 22 to 558 /etc/fail2ban/jail.local, update port from 22 to 558 add a new record in iptables iptables -A INPUT -p tcp -m multiport --dports 558 -...
code-8's user avatar
  • 452
4 votes
0 answers
4k views

Fail2ban & nftables errors, IPs not banned

So I've been experimenting with nftables in CentOS 8 and things are going pretty well, but I'm having a weird problem with fail2ban. Fail2ban cannot ban IPs with nftables-multiport or nftables-...
b6-redacted's user avatar
5 votes
2 answers
2k views

How can I hide failed ssh attempts for users that don't exist?

The Question How can I exclude inconsequential¹ failed SSH logins? Background For ambient awareness, I like to have little background windows showing system error logs on every GNU/Linux box I ...
hackerb9's user avatar
  • 1,569
0 votes
1 answer
301 views

How to configure fail2ban without a log file?

I am trying to configure a policy in fail2ban - the detection and identity of bad behaviour is rather complex in my case, so I was planning to handle this in a dedicated program. Rather than having ...
symcbean's user avatar
  • 5,831
4 votes
1 answer
2k views

fail2ban applying ban but is not blocking the connection

I have a fail2ban setup enabled for sshd on CentOS. It is reading the logs fine. Doing some testing with SSH failed logins from a remote server: Nov 23 20:51:52 new fail2ban.filter[29090]: INFO [sshd]...
Zeno's user avatar
  • 263
9 votes
1 answer
2k views

Large fail2ban database, normal?

The fail2ban database on my server is quite large (420MB). The fail2ban log is quite busy (there is a "filter" entry every two seconds) but iptables shows only a few banned addresses. dbpurgeage is ...
xenoid's user avatar
  • 9,028
0 votes
1 answer
477 views

Can't Start Fail2Ban

Lately I got 3 emails from Fail2Ban The jail nginx-http-auth has been stopped. The jail nginx-badbots has been stopped. The jail ssh has been stopped. Then I start SSH into my VM, this is the log ...
code-8's user avatar
  • 452
-2 votes
1 answer
84 views

Fail2ban adding new chain

how to create a new chain that appear in first position (before recidive) that create iptables rules to block an entire IP class if recidive has N IP's of that block? thx in advance
giuseppe's user avatar
0 votes
1 answer
285 views

Bulk login attempts on port 22 shutdown our SSH git server access, HTTPs still works though

Recently we have been seeing a lot of connections from IPs in to our public git server. When this happens, our devs are unable to commit via SSH as the server is very, very slow and I am unable to ...
saleetzo's user avatar
  • 590