Questions tagged [fail2ban]
anti-bruteforcing daemon that works on connection attempts to services such as SSH
93
questions
0
votes
0answers
16 views
Strange ban when attempting to make request on a server
I am currently getting banned, every time I try to make a REST request onto an Elasticsearch server hosted inside a LXC container. The host of LXC containers is a Debian Stretch.
The Ban is not only ...
0
votes
2answers
44 views
REGEX: flush a number of related chains in iptables
I want to flush a number of related chains in IPtables. Their names like 'f2b.*'
I want the entire chain gone!
e.g. all this gone.
-A f2b-postfix-sasl -s 103.231.139.130/32 -j REJECT --reject-with ...
1
vote
0answers
19 views
fail2ban not detecting ssh failures on CentOS 7
I've installed fail2ban on CentOS 7 and added jail.local:
[sshd]
enabled = true
When I try a bad ssh login, I get a log entry in /var/log/secure like this:
Jun 5 11:09:40 arsenal sshd[32595]: ...
0
votes
0answers
41 views
fail2ban not blocking access to imap ports
I have a mail server with dovecot. I run fail2ban on it, with the jail [dovecot] enabled. Here is the status of that jail.
# fail2ban-client status dovecot
Status for the jail: dovecot
|- Filter
| |...
3
votes
2answers
64 views
How to show “number of failed login attempts” on a successful ssh login?
I use CentOS 7 on a host. There used to be a report of the number of failed login attempts shown whenever I logged into the machine using SSH. The full banner was something like this:
Last failed ...
1
vote
0answers
21 views
fail2ban unexpectedly “starts” causing duplicate iptables entries and flushlogs running at 99% cpu [closed]
I've recently configured a Ubuntu16 server and I'm getting "fail2ban started" emails sent again even though the server did not restart. I noticed this has happened twice, both times the emails came in ...
0
votes
1answer
30 views
iptables Performance with long chains
I'd like to know if long chains in iptables is likely to cause a performance issue. Here a long chain might be >2,500 individual IP bans.
My concern is that my limited knowledge of iptables suggests ...
4
votes
0answers
65 views
fail2ban too slow, banning after the attack
We had a "register"-attack to our voip server (freeswitch).
In the Logs it looks something like this:
2019-04-25 14:35:16.137965 [WARNING] sofia_reg.c:1743 SIP auth failure (REGISTER) on sofia ...
0
votes
1answer
23 views
UFW Syntax to find and delete ONE rule among 4279 UFW REJECT IN rules
I've setup Fail2Ban to use UFW actions to permanently ban IPs after 1 failed attempt. What seemed like a good idea are now causing me problems as I need to remove one IP among all those ufw rules.
...
3
votes
0answers
42 views
Why fail2ban would ban an IP that is whitelisted (on ignoreip)?
I have fail2ban configured to protect the authentication on a postfix service.
The jail is working properly on the ban side, but the ignoreip option seems to be ignored or misconfigured since it bans ...
0
votes
1answer
57 views
Fail2ban regex: how to NOT get host name but ip?
In my access.log I got somerow a
ip - - [date] method link ... etc..
and some others with
www.domain.com:ip - - [date] method link ... etc..
I am actually using this regexp
^<HOST>.*/...
1
vote
1answer
144 views
fail2ban has banned my Ip but I can still login using SSH
I done a fresh new install of fail2ban on a Debian 9.8
I copied /etc/fail2ban/jail.conf as jail.local.
And in my jail.local in added enabled=true under [ssh]
Tailing fail2ban's log I can see what ...
0
votes
0answers
131 views
Docker between-container iptables and fail2ban?
Say I have a public-facing Nginx reverse proxy container (A) that sends traffic to a downstream web service (B). This A container is where TLS connections terminate. The Docker server is also behind ...
1
vote
1answer
79 views
fail2ban will not ban again after first one expires
I couldn't make fail2ban to block IP address coming up in postfix log on Debian 9. I rewrote the failregex to be like this:
NOQUEUE: reject: RCPT from (.*)\[<HOST>\]:(.*) 550 5.7.1 Service ...
0
votes
0answers
156 views
Why does fail2ban not trigger my custom filter?
fail2ban-regex verified that my filter matches Jan 14 07:39:41 myhost01 sshd[26433]: Connection closed by authenticating user root 127.0.0.1 port 56216 [preauth] 68 times inside auth.log, but fail2ban-...
3
votes
1answer
955 views
How to automatically permanently ban IP addresses?
Currently I have been using iptables on a new Debian server running Asterisk.
Every day I have been checking auth.log for IP addresses and manually doing iptables -A INPUT -s IPA.DRE.SS.0/24 -j DROP
...
0
votes
1answer
64 views
Fail2ban Debian 9, freeswitch
My server goes crazy with the CPU when I reload fail2ban and sometimes mid day as well the CPU goes very high.
I remember a while ago I was told to switch to systemd, any idea on how to do it?
2
votes
1answer
188 views
mosquitto bruteforce fail2ban failregex
I am trying to write fail2ban filter to block bruteforcing IP addresses which are trying to subscribe to username/password protected mosquitto service by guessing username/password combinations.
On ...
1
vote
1answer
390 views
fail2ban with iptables-persistent
I've been running fail2ban for a bit, and recently installed iptables-persistent and am using it with ipset for a blacklist (there's one particular IP that is always hammering away at this machine). ...
0
votes
1answer
122 views
Can't install fail2ban on CentOS 6.9
I can't install fail2ban on my CentOS 6.9. Here is my config
# cat /etc/*release
CentOS release 6.9 (Final)
CentOS release 6.9 (Final)
CentOS release 6.9 (Final)
# rpm -q epel-release
epel-release-...
0
votes
1answer
283 views
fail2ban fails 2 ban login attemps to smtp (postfix) server in docker container
I got a problem with my host / docker setting as follows:
Host runs fail2ban, which accesses the mail.log files from the docker container, which are mapped over a volume. This all works fine, I ...
1
vote
1answer
86 views
fail2ban conf file
I'm running:
Fail2Ban v0.9.6
on Debian 9.4 (4.9.0-6-amd64 #1 SMP Debian 4.9.88-1+deb9u1 (2018-05-07) x86_64 GNU/Linux)
This is my F2B directory:
$ la -al /etc/fail2ban
total 72K
drwxr-xr-x 6 ...
0
votes
1answer
131 views
Run fail2ban-regex by piping with zcat?
Normally running the command would go like this:
$ fail2ban-regex /var/log/ningx/access.log \
/etc/fail2ban/filter.d/nginx-noscript.conf -v
However, I have multiple files that I'd like to parse ...
4
votes
1answer
845 views
How does fail2ban protect against DDoS?
How does fail2ban protect against SSH DDoS attacks? What does it do in the case of a DDoS attack? And how does it determine if it is a DDoS?
I am asking only about DDoS attacks.
(I assume it really ...
0
votes
2answers
465 views
Can't list any iptables rules with iptables -Lvn
I just installed fail2ban and when I wanted to check if ssh iptables jail is running. That is when I saw that iptables -Lvn list nothing. Iptables are running with custom script but I have no idea why ...
1
vote
3answers
1k views
fail2ban keeps saying already banned but it didn't actually ban
I just configured a new server and installed fail2ban as well, but it is not banning me when I keep trying to connect with the wrong password
fail2ban.log:
2018-03-23 12:46:29,363 fail2ban.actions ...
0
votes
2answers
737 views
Fedora, Fail2ban : Fail2ban wont show up in iptables -L
I have Fedora installed on one our servers and installed fail2ban on it. in jail.conf, I have added the below text, but iptables -L still wont show the fail2ban-ssh. Am I missing something? Thank you. ...
0
votes
1answer
173 views
How can I get fail2ban to install on Centos 7.4?
I've done yum install epel-release and this shows in my repolist:
repo id repo name ...
0
votes
1answer
264 views
Block all IPs for SSH/SSHD with iptables/fail2ban or firewalld?
I'm trying to learn Linux and get familiar with it. How do I block all IPs except two certain IPs on different subnets for SSH/SSHD? I've been trying to Google for an answer but nothing seem to work ...
0
votes
1answer
388 views
Fail2ban logging to systemd
I am trying to set the fail2ban's backend to systemd.
File:
/etc/fail2ban/jail.local
Option:
backend = systemd
And it won't start, logs:
2018-06-27 12:09:53,387 fail2ban.jail [10240]: ...
1
vote
1answer
72 views
Why are there both printf and print in this command?
While studying about fail2ban I came across this command. I never worked with awk before, only with sed. I don't understand why there are both printf and print, there:
awk '{ printf "# "; print; }' /...
4
votes
2answers
2k views
creating an alternate jail in fail2ban for manual banning
I have a fail2ban instance that works well.
But I also like to occasionally examine the logs manually and try to ID system probes that are working around my standard f2b definitions.
What I'm ...
0
votes
2answers
1k views
dpkg: error processing package fail2ban (--configure):
I am trying to install fail2ban service on my ubuntu server 16.04, but i have this error and fail2ban service cannot start, what's the problem?
root@clm:~# apt install fail2ban
Reading package lists.....
0
votes
1answer
212 views
Fail2ban is started but am not seeing any activity on journalctl
I installed fail2ban, created .local versions of the supplied config files and started the service. The service is started as below. However I see no entries whatsoever in journalctl. How do I know it ...
0
votes
2answers
881 views
fail2ban:11 lines must begin with a keyword or a filename (possibly in double quotes)
I am rotating the logs of my Fail2Ban service on a daily basis, but, I keep getting this error on a daily basis:
/etc/cron.daily/logrotate:
error: fail2ban:11 lines must begin with a keyword or a ...
-1
votes
1answer
607 views
fail2ban not blocking right away
I set up a fail2ban system on my server to restrict SSH access. It works fine, except that after entering the username on the unit, if I enter the password incorrect 3 times (my maxretry value), it ...
0
votes
1answer
148 views
Fail2Ban not picking up dropbear auth failures - again
RASPBIAN Jessie
Edit: It is working from some clients
From another Rasberry Pi the log is working and now picking up the proper entry in the log
Jul 22 04:02:21 <HOSTNAME> dropbear[2462]: Bad ...
0
votes
1answer
330 views
Fail2Ban not picking up dropbear auth failures
raspbian
Linux [hostname] 4.9.36+ #1015 Thu Jul 6 16:07:57 BST 2017 armv6l GNU/Linux
fail2ban is not picking up the dropbear auth failures. This was working for openssh without issues. I went to ...
0
votes
1answer
908 views
Fail2Ban with DDWRT or router
How can I use fail2ban with DDWRT or a router?
I love using fail2ban, but there is no info about using fail2ban in a linux base ddwrt / optware / entware and so on.
2
votes
1answer
2k views
Fail2Ban fails to start on CentOS 7
I'm running CentOS 7, all fully updated, and am trying to get Fail2Ban to work, but I'm running into problems.
Specifically, I'm trying to block brute force SSH attacks. I'm pretty sure I've set up ...
3
votes
0answers
831 views
Fail2Ban fails to ban!
I get a lot of IPs that try probing my sites so I set up a filter to ban them after a few 404 errors.
But something is not working because I get a bunch of these instead:
2017-06-07 01:08:37,175 ...
1
vote
1answer
624 views
Fail2Ban custom filter not applied
I tried to create a custom jail rule in fail2ban, but it never gets applied.
I did not find such an official documentation, I might miss something.
/etc/fail2ban/filter.d/expressjs.conf
[...
2
votes
1answer
331 views
Does it exist a fail2ban alternative in official Centos repository?
If I don't want to add other repository (EPEL for example) than the official ones that are coming with a fresh CentOS install, is there a more official alternative than fail2ban?
1
vote
0answers
188 views
Fail2ban: cannot change default chain
OK: so I have fail2ban installed on a Debian 8.7 machine: I have a iptables that looks like this:
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N fail2ban-ssh-daily
-N fail2ban-ssh-permaban
-...
1
vote
1answer
664 views
How do I force vsftpd to log the numeric IP address on connection attempts?
Scanning through my log files, I see repeated unauthorized attempts to log in to my FTP server. The system uses rDNS to give me a hostname of the remote user, and if rDNS gives an answer — even a ...
1
vote
3answers
2k views
Restore original fail2ban configuration on CentOS 7
I installed fail2ban from EPEL using yum install, and then proceeded to screw up the configuration after forgetting to back up /etc/fail2ban.
Now I want the original configuration back.
First I ...
2
votes
2answers
8k views
fail2ban is running but no fail2ban.log log file exists for it
I've set up fail2ban on a centos VPS used for a few mail accounts among other things and want to check that everything is running smoothly. According to fail2ban-client status everything is running as ...
3
votes
1answer
2k views
Why does Fail2ban not send mail for one particular jail?
Fail2ban is doing it's job and fail2ban-client status is showing me they're all working fine and offending addresses get blocked.
When an address is blocked I like to receive a mail. That's working ...
0
votes
3answers
180 views
Debian linux systemd shutdown, have shorewall service wait for fail2ban service
Running Debian unstable with shorewall for the firewall and fail2ban. Was getting "shorewall not running errors" upon boot up in the fail2ban log, but that was fixed with
After=network.target
in /...
1
vote
1answer
1k views
Adding iptables rules after implementing fail2ban
I recently implemented fail2ban on a fresh debian server which left me with some default iptables configuration automatically,
root@plutarchy:/etc/apache2# iptables -S
-P INPUT ACCEPT
-P FORWARD ...
