Questions tagged [fail2ban]
anti-bruteforcing daemon that works on connection attempts to services such as SSH
127
questions
0
votes
0
answers
14
views
Why VNC Client gives Too-Many-Authentication-Failures message despite Fail2Ban?
On server have fail2ban only and no ufw (this is deliberate and part of the spec).
Have a specific jail for tightvnc-auth; and when I look at logs -- no failed connection attempts made.
I do have ...
0
votes
2
answers
69
views
Iptables and fail2ban on Yocto Linux
I've installed both iptables and fail2ban on my embedded Yocto-Linux. When fail2ban set the following command:
iptables -w -I INPUT -p tcp -m multiport --dports http,https -j f2b-NoScript
I have that ...
0
votes
0
answers
338
views
fail2ban : Active: failed (Result: exit-code)
fail2ban.service - Fail2Ban Service
Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; enabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Sun 2022-01-02 16:19:50 +...
- 1
1
vote
1
answer
37
views
How do I start Ubuntu's ufw before fail2ban to solve a loss of connectivity issue?
My skill level configuring systemd is more of a newbie and need help as I've now hit a road block and I'm stuck.
I have fail2ban and ufw installed on a Raspberry Pi clone board. The problem I've ...
- 33
0
votes
1
answer
34
views
My custom fail2ban jail fails to load even though fail2ban-regex suggests that it should work?
I've written a custom jail and filter in fail2ban for logging into my service. The log file is located in /var/log/motion/motion.log and a failed login generates a line like this:
[0:ml1] [ALR] [STR] [...
0
votes
1
answer
105
views
VNC too many authentication failures error - Fail2ban
On a Debian 11 server with Xtightvnc, I am getting a lot of "too many authentication failures" messages.
I would like to put fail2ban to block unauthorized users who try to login into my ...
- 125
0
votes
1
answer
88
views
fail2ban: how to customize filters and based on time-occurs?
I have an application, and seems it was attacked by huge ips.
log file: /root/kitty/nohup.out
process: kitty
port: 8888
[2021-08-31 10:02:20] [ALL] 168.138.142.22:50384 incoming connection
[2021-08-...
- 101
1
vote
2
answers
374
views
Fail2ban Regex help for banning sshd connection attempts
This is a tricky questions (for me)
I'm trying to setup fail2ban to BAN all connection attempts to my ssh server that don't login.
Now, my issue is.. everything, in the file filter.d/sshd.conf.
for me ...
- 327
0
votes
1
answer
260
views
fail2ban / FirewallD error: invalid port/service `1-65535' specified
I am running a CentOS 8.4 server. When I do a systemctl status firewalld I see the daemon is active and running, but I see the following error repeated five times:
ERROR: '/usr/sbin/iptables-restore -...
- 53
1
vote
0
answers
194
views
Fail2ban actionban with cURL
My Ubuntu server mail is working. I verified with this command below.
echo "Mail is working on this server." | mail -s subject <myemail@gmail.com>
In my entire jail.local
ex. intruder ...
- 372
0
votes
1
answer
227
views
How can I use fail2ban with ipv6?
I have used the Fail2ban for a long time. I think this script is not able to manage the IPv6 -- or maybe it is working with IPv6?
How can I prevent IPv6 attacks with Fail2ban or do I have to search ...
0
votes
1
answer
445
views
Writing a fail2ban multiline regex
I'm not sure if this the correct regex, but i'm trying to add multiple lines at the ignoreregex
Here are the config lines in my ddos.conf:
[Definition]
failregex = ^<HOST> -.*"(GET|POST).*
...
- 151
2
votes
2
answers
299
views
fail2ban and iptables rules flood (resulting in poor bandwidth)
I've noticed this pattern happening a few times on my server in the last 6 months:
First, fail2ban detects many SSH attempts from bots, and sucessfully bans them. Indeed in /etc/fail2ban/jail.conf I ...
- 2,245
1
vote
0
answers
364
views
Blocking FTP Brute Force Attack with Snort
I am trying to become familiar with Snort, and for this reason, I have set three VMs. A Kali, a windows machine with XAMPP and Ubuntu where I installed Snort.
I believe I have Snort running in ...
- 11
1
vote
1
answer
1k
views
fail2ban - have more than one regex in same filter file
I have the following in my fail2ban/filter.d/apache-scripts.conf file:
[INCLUDES] before = botsearch-common.conf
[Definition]
failregex = (<HOST>).*(GET|HEAD|POST|PUT)\ \/(site\/|blog\/|old\/|...
- 131
0
votes
1
answer
749
views
Fail2Ban Regex - NGNIX - Custom Regex
I am trying to create a custom log file for fail2ban NGNIX logs to catch a specific event. Regex is still relatively new to me so im trying to improve. This will be put into a custom filter but for ...
- 13
1
vote
0
answers
957
views
fail2ban not banning ssh
Trying to setup fail2ban sshd on Ubuntu 20.
# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
| |- Currently failed: 0
| |- Total failed: 0
| `- File list: /var/log/auth....
- 202
0
votes
1
answer
352
views
How to configure fail2ban file?
I installed fail2ban but When I enter fail2ban-client status in the Linux terminal, I get the following warnings:
fail2ban.configreader [1616]: ERROR Found no accessible config files for 'filter.d/...
- 1
1
vote
2
answers
96
views
Is fail2ban required if already using firewalld and restricting ssh
I have seen a lot of posts showing how to install fail2ban along with firewalld and wanted to know if fail2ban is really required for my set up.
My set up is as follows
Cent OS 8 in a VPS
Public ...
- 121
2
votes
0
answers
650
views
How can I enable/disable a jail using fail2ban?
We can add a line like this below a specific jail in the jail.local file, and control the jail:
enabled = true/false
But I think there should be a command to do this, as we've got bunch of "set&...
1
vote
1
answer
2k
views
Server being attacked with key exchange attempts. Not being added to ban list by fail2ban
Looking through the sshd logs, there is a remote machine which appears to be attacking my server. here is an example of an entry. It is always the same IP.
May 8 17:57:32 [removed] sshd[99267]: ...
- 688
0
votes
2
answers
813
views
How to prevent unban in fail2ban?
After configuring a port 22 forward from my router to my raspberry pi, I found that there were a TON of IPs trying to get in daily. I have tried to make my system more secure by setting up ufw and ...
- 105
3
votes
1
answer
24k
views
SSH "kex_exchange_identification: read: Connection reset by peer"
The setup:
Raspberry 3B running Raspbian Stretch 9 on an external HDD and using ZRAM
Raspi used as a webserver running LAMP and MERN stacks and accessed remotely via SSH with 1 IDE (Coda for Mac OS)
...
- 71
2
votes
1
answer
1k
views
Fail2ban multiple actions
I am trying to create a jail for fail2ban, where upon a regex match I want to block the source IP from reaching either port 80 or 443 on my server.
I've tried variations of this:
action = iptables[...
- 1,312
0
votes
1
answer
288
views
Can't find where to enabled Fail2Ban Features - Ubuntu
I followed a site to install and configure Fail2Ban
apt-get update && apt-get upgrade -y
apt-get install fail2ban
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
cat jail.local
I ...
- 372
1
vote
1
answer
55
views
What should I check when I can't SSH into my box?
I update my :
/etc/ssh/sshd_config, update port from 22 to 558
/etc/fail2ban/jail.local, update port from 22 to 558
add a new record in iptables
iptables -A INPUT -p tcp -m multiport --dports 558 -...
- 372
4
votes
0
answers
3k
views
Fail2ban & nftables errors, IPs not banned
So I've been experimenting with nftables in CentOS 8 and things are going pretty well, but I'm having a weird problem with fail2ban.
Fail2ban cannot ban IPs with nftables-multiport or nftables-...
- 41
3
votes
2
answers
918
views
How can I hide failed ssh attempts for users that don't exist?
The Question
How can I exclude inconsequential¹ failed SSH logins?
Background
For ambient awareness, I like to have little background windows showing system error logs on every GNU/Linux box I ...
- 1,237
0
votes
1
answer
93
views
How to configure fail2ban without a log file?
I am trying to configure a policy in fail2ban - the detection and identity of bad behaviour is rather complex in my case, so I was planning to handle this in a dedicated program. Rather than having ...
- 4,225
4
votes
1
answer
1k
views
fail2ban applying ban but is not blocking the connection
I have a fail2ban setup enabled for sshd on CentOS. It is reading the logs fine. Doing some testing with SSH failed logins from a remote server:
Nov 23 20:51:52 new fail2ban.filter[29090]: INFO [sshd]...
- 263
8
votes
1
answer
1k
views
Large fail2ban database, normal?
The fail2ban database on my server is quite large (420MB).
The fail2ban log is quite busy (there is a "filter" entry every two seconds) but iptables shows only a few banned addresses.
dbpurgeage is ...
- 7,854
0
votes
1
answer
121
views
Can't Start Fail2Ban
Lately I got 3 emails from Fail2Ban
The jail nginx-http-auth has been stopped.
The jail nginx-badbots has been stopped.
The jail ssh has been stopped.
Then I start SSH into my VM, this is the log
...
- 372
-2
votes
1
answer
38
views
Fail2ban adding new chain
how to create a new chain that appear in first position (before recidive) that create iptables rules to block an entire IP class if recidive has N IP's of that block?
thx in advance
- 3
0
votes
1
answer
163
views
Bulk login attempts on port 22 shutdown our SSH git server access, HTTPs still works though
Recently we have been seeing a lot of connections from IPs in to our public git server. When this happens, our devs are unable to commit via SSH as the server is very, very slow and I am unable to ...
- 550
0
votes
0
answers
2k
views
Failed use Fail2ban: No file(s) found for glob /var/log/audit/audit.log
I'm tring use a Fail2ban on Raspbian follow this tutorial, but it didn't work, and appear this error:
root@raspberrypi:~# fail2ban-server
No file(s) found for glob /var/log/audit/audit.log
Failed ...
- 964
0
votes
1
answer
189
views
Changed ssh port to 1234, can't connect to server, fail2ban in use
I just changed my ssh port to 1234 and now i cant access my server any more.
Also I set AllowUsers stephan in /etc/ssh/sshd_config
I have fail2ban installed and i am trying to login as root user. ...
- 11
0
votes
2
answers
357
views
REGEX: flush a number of related chains in iptables
I want to flush a number of related chains in IPtables. Their names like 'f2b.*'
I want the entire chain gone!
e.g. all this gone.
-A f2b-postfix-sasl -s 103.231.139.130/32 -j REJECT --reject-with ...
- 407
1
vote
0
answers
282
views
fail2ban not detecting ssh failures on CentOS 7
I've installed fail2ban on CentOS 7 and added jail.local:
[sshd]
enabled = true
When I try a bad ssh login, I get a log entry in /var/log/secure like this:
Jun 5 11:09:40 arsenal sshd[32595]: ...
- 493
0
votes
0
answers
234
views
fail2ban not blocking access to imap ports
I have a mail server with dovecot. I run fail2ban on it, with the jail [dovecot] enabled. Here is the status of that jail.
# fail2ban-client status dovecot
Status for the jail: dovecot
|- Filter
| |...
- 143
3
votes
2
answers
3k
views
How to show "number of failed login attempts" on a successful ssh login?
I use CentOS 7 on a host. There used to be a report of the number of failed login attempts shown whenever I logged into the machine using SSH. The full banner was something like this:
Last failed ...
- 153
0
votes
1
answer
414
views
iptables Performance with long chains
I'd like to know if long chains in iptables is likely to cause a performance issue. Here a long chain might be >2,500 individual IP bans.
My concern is that my limited knowledge of iptables suggests ...
- 14.4k
4
votes
0
answers
614
views
fail2ban too slow, banning after the attack
We had a "register"-attack to our voip server (freeswitch).
In the Logs it looks something like this:
2019-04-25 14:35:16.137965 [WARNING] sofia_reg.c:1743 SIP auth failure (REGISTER) on sofia ...
- 51
0
votes
1
answer
117
views
UFW Syntax to find and delete ONE rule among 4279 UFW REJECT IN rules
I've setup Fail2Ban to use UFW actions to permanently ban IPs after 1 failed attempt. What seemed like a good idea are now causing me problems as I need to remove one IP among all those ufw rules.
...
- 3
3
votes
0
answers
280
views
Why fail2ban would ban an IP that is whitelisted (on ignoreip)?
I have fail2ban configured to protect the authentication on a postfix service.
The jail is working properly on the ban side, but the ignoreip option seems to be ignored or misconfigured since it bans ...
- 399
0
votes
1
answer
226
views
Fail2ban regex: how to NOT get host name but ip?
In my access.log I got somerow a
ip - - [date] method link ... etc..
and some others with
www.domain.com:ip - - [date] method link ... etc..
I am actually using this regexp
^<HOST>.*/...
- 541
2
votes
1
answer
1k
views
fail2ban has banned my Ip but I can still login using SSH
I done a fresh new install of fail2ban on a Debian 9.8
I copied /etc/fail2ban/jail.conf as jail.local.
And in my jail.local in added enabled=true under [ssh]
Tailing fail2ban's log I can see what ...
- 541
1
vote
1
answer
2k
views
Docker between-container iptables and fail2ban?
Say I have a public-facing Nginx reverse proxy container (A) that sends traffic to a downstream web service (B). This A container is where TLS connections terminate. The Docker server is also behind ...
- 517
2
votes
1
answer
212
views
fail2ban will not ban again after first one expires
I couldn't make fail2ban to block IP address coming up in postfix log on Debian 9. I rewrote the failregex to be like this:
NOQUEUE: reject: RCPT from (.*)\[<HOST>\]:(.*) 550 5.7.1 Service ...
- 347
0
votes
0
answers
1k
views
Why does fail2ban not trigger my custom filter?
fail2ban-regex verified that my filter matches Jan 14 07:39:41 myhost01 sshd[26433]: Connection closed by authenticating user root 127.0.0.1 port 56216 [preauth] 68 times inside auth.log, but fail2ban-...
- 71
4
votes
1
answer
6k
views
How to automatically permanently ban IP addresses?
Currently I have been using iptables on a new Debian server running Asterisk.
Every day I have been checking auth.log for IP addresses and manually doing iptables -A INPUT -s IPA.DRE.SS.0/24 -j DROP
...
- 175