Questions tagged [fail2ban]

anti-bruteforcing daemon that works on connection attempts to services such as SSH

Filter by
Sorted by
Tagged with
0
votes
1answer
20 views

Can't Start Fail2Ban

Lately I got 3 emails from Fail2Ban The jail nginx-http-auth has been stopped. The jail nginx-badbots has been stopped. The jail ssh has been stopped. Then I start SSH into my VM, this is the log ...
2
votes
1answer
2k views

Fail2Ban fails to start on CentOS 7

I'm running CentOS 7, all fully updated, and am trying to get Fail2Ban to work, but I'm running into problems. Specifically, I'm trying to block brute force SSH attacks. I'm pretty sure I've set up ...
0
votes
1answer
32 views

Bulk login attempts on port 22 shutdown our SSH git server access, HTTPs still works though

Recently we have been seeing a lot of connections from IPs in to our public git server. When this happens, our devs are unable to commit via SSH as the server is very, very slow and I am unable to ...
-2
votes
1answer
13 views

Fail2ban adding new chain

how to create a new chain that appear in first position (before recidive) that create iptables rules to block an entire IP class if recidive has N IP's of that block? thx in advance
1
vote
1answer
188 views

Docker between-container iptables and fail2ban?

Say I have a public-facing Nginx reverse proxy container (A) that sends traffic to a downstream web service (B). This A container is where TLS connections terminate. The Docker server is also behind ...
1
vote
1answer
4k views

Fail2ban with firewalld

I'm trying to configure fail2ban to block ssh from a local hosts. Fail2ban is install on CentOS 7 with firewall (Linux 3.10.0-229.4.2.el7.x86_64 x86_64 ). I have copied the jail.conf to jail.local i ...
0
votes
0answers
46 views

Failed use Fail2ban: No file(s) found for glob /var/log/audit/audit.log

I'm tring use a Fail2ban on Raspbian follow this tutorial, but it didn't work, and appear this error: root@raspberrypi:~# fail2ban-server No file(s) found for glob /var/log/audit/audit.log Failed ...
0
votes
1answer
16 views

Changed ssh port to 1234, can't connect to server, fail2ban in use

I just changed my ssh port to 1234 and now i cant access my server any more. Also I set AllowUsers stephan in /etc/ssh/sshd_config I have fail2ban installed and i am trying to login as root user. ...
1
vote
1answer
1k views

Adding iptables rules after implementing fail2ban

I recently implemented fail2ban on a fresh debian server which left me with some default iptables configuration automatically, root@plutarchy:/etc/apache2# iptables -S -P INPUT ACCEPT -P FORWARD ...
2
votes
1answer
865 views

Fail2ban - send email with msmtp

How do I set up fail2ban to send emails using msmtp? I tried changing the mta = sendmail line to mta = msmtp and the action = %(action_)s line to action = %(action_mwl)s. I think /etc/fail2ban/...
0
votes
3answers
184 views

Debian linux systemd shutdown, have shorewall service wait for fail2ban service

Running Debian unstable with shorewall for the firewall and fail2ban. Was getting "shorewall not running errors" upon boot up in the fail2ban log, but that was fixed with After=network.target in /...
0
votes
2answers
59 views

REGEX: flush a number of related chains in iptables

I want to flush a number of related chains in IPtables. Their names like 'f2b.*' I want the entire chain gone! e.g. all this gone. -A f2b-postfix-sasl -s 103.231.139.130/32 -j REJECT --reject-with ...
0
votes
0answers
17 views

Strange ban when attempting to make request on a server

I am currently getting banned, every time I try to make a REST request onto an Elasticsearch server hosted inside a LXC container. The host of LXC containers is a Debian Stretch. The Ban is not only ...
1
vote
3answers
1k views

fail2ban keeps saying already banned but it didn't actually ban

I just configured a new server and installed fail2ban as well, but it is not banning me when I keep trying to connect with the wrong password fail2ban.log: 2018-03-23 12:46:29,363 fail2ban.actions ...
2
votes
1answer
1k views

fail2ban works fine on bad SSH attempts, but fails on bad Apache2 attempts

I'm running Debian Linux. uname --all shows: Linux xxx.xx 2.6.32-5-686 #1 SMP Tue May 13 16:33:32 UTC 2014 i686 GNU/Linux I'm running sshd on a port that is not 22. I've updated /etc/fail2ban/jail....
1
vote
0answers
35 views

fail2ban not detecting ssh failures on CentOS 7

I've installed fail2ban on CentOS 7 and added jail.local: [sshd] enabled = true When I try a bad ssh login, I get a log entry in /var/log/secure like this: Jun 5 11:09:40 arsenal sshd[32595]: ...
9
votes
4answers
8k views

How to configure fail2ban with systemd journal?

I've install fail2ban on Debian Jessie LXC container, currently it's failing due to: Starting authentication failure monitor: fail2ban ERROR No file(s) found for glob /var/log/auth.log ERROR Failed ...
0
votes
1answer
1k views

is iptables broken on my raspberry-pi? how to fix?

I am getting some person(s) trying to brute force my ssh, from multiple ip addresses (small sample) : May 22 19:50:02 rpi sshd[1272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=...
0
votes
0answers
69 views

fail2ban not blocking access to imap ports

I have a mail server with dovecot. I run fail2ban on it, with the jail [dovecot] enabled. Here is the status of that jail. # fail2ban-client status dovecot Status for the jail: dovecot |- Filter | |...
3
votes
2answers
126 views

How to show “number of failed login attempts” on a successful ssh login?

I use CentOS 7 on a host. There used to be a report of the number of failed login attempts shown whenever I logged into the machine using SSH. The full banner was something like this: Last failed ...
12
votes
8answers
41k views

Delete all fail2ban bans in Ubuntu Linux

How can I delete all fail2ban bans in Ubuntu? I tried everything but I don't get it. I just want to delete all bans - but I don't know any IP adresses.
0
votes
1answer
35 views

iptables Performance with long chains

I'd like to know if long chains in iptables is likely to cause a performance issue. Here a long chain might be >2,500 individual IP bans. My concern is that my limited knowledge of iptables suggests ...
4
votes
0answers
81 views

fail2ban too slow, banning after the attack

We had a "register"-attack to our voip server (freeswitch). In the Logs it looks something like this: 2019-04-25 14:35:16.137965 [WARNING] sofia_reg.c:1743 SIP auth failure (REGISTER) on sofia ...
0
votes
1answer
24 views

UFW Syntax to find and delete ONE rule among 4279 UFW REJECT IN rules

I've setup Fail2Ban to use UFW actions to permanently ban IPs after 1 failed attempt. What seemed like a good idea are now causing me problems as I need to remove one IP among all those ufw rules. ...
1
vote
1answer
3k views

Block ESTABLISHED connections with firewalld/iptables

I am running firewalld on my server and I am trying to setup a fail2ban (using firewalld) in order to improve security. The problem is: I can't get it to kill established connections. Firewalld has ...
3
votes
0answers
59 views

Why fail2ban would ban an IP that is whitelisted (on ignoreip)?

I have fail2ban configured to protect the authentication on a postfix service. The jail is working properly on the ban side, but the ignoreip option seems to be ignored or misconfigured since it bans ...
0
votes
1answer
69 views

Fail2ban regex: how to NOT get host name but ip?

In my access.log I got somerow a ip - - [date] method link ... etc.. and some others with www.domain.com:ip - - [date] method link ... etc.. I am actually using this regexp ^<HOST>.*/...
1
vote
1answer
198 views

fail2ban has banned my Ip but I can still login using SSH

I done a fresh new install of fail2ban on a Debian 9.8 I copied /etc/fail2ban/jail.conf as jail.local. And in my jail.local in added enabled=true under [ssh] Tailing fail2ban's log I can see what ...
2
votes
2answers
9k views

fail2ban is running but no fail2ban.log log file exists for it

I've set up fail2ban on a centos VPS used for a few mail accounts among other things and want to check that everything is running smoothly. According to fail2ban-client status everything is running as ...
1
vote
1answer
94 views

fail2ban will not ban again after first one expires

I couldn't make fail2ban to block IP address coming up in postfix log on Debian 9. I rewrote the failregex to be like this: NOQUEUE: reject: RCPT from (.*)\[<HOST>\]:(.*) 550 5.7.1 Service ...
1
vote
3answers
2k views

Restore original fail2ban configuration on CentOS 7

I installed fail2ban from EPEL using yum install, and then proceeded to screw up the configuration after forgetting to back up /etc/fail2ban. Now I want the original configuration back. First I ...
1
vote
1answer
96 views

fail2ban conf file

I'm running: Fail2Ban v0.9.6 on Debian 9.4 (4.9.0-6-amd64 #1 SMP Debian 4.9.88-1+deb9u1 (2018-05-07) x86_64 GNU/Linux) This is my F2B directory: $ la -al /etc/fail2ban total 72K drwxr-xr-x 6 ...
0
votes
0answers
202 views

Why does fail2ban not trigger my custom filter?

fail2ban-regex verified that my filter matches Jan 14 07:39:41 myhost01 sshd[26433]: Connection closed by authenticating user root 127.0.0.1 port 56216 [preauth] 68 times inside auth.log, but fail2ban-...
3
votes
1answer
1k views

How to automatically permanently ban IP addresses?

Currently I have been using iptables on a new Debian server running Asterisk. Every day I have been checking auth.log for IP addresses and manually doing iptables -A INPUT -s IPA.DRE.SS.0/24 -j DROP ...
0
votes
1answer
365 views

Fail2Ban not picking up dropbear auth failures

raspbian Linux [hostname] 4.9.36+ #1015 Thu Jul 6 16:07:57 BST 2017 armv6l GNU/Linux fail2ban is not picking up the dropbear auth failures. This was working for openssh without issues. I went to ...
2
votes
1answer
242 views

mosquitto bruteforce fail2ban failregex

I am trying to write fail2ban filter to block bruteforcing IP addresses which are trying to subscribe to username/password protected mosquitto service by guessing username/password combinations. On ...
0
votes
1answer
72 views

Fail2ban Debian 9, freeswitch

My server goes crazy with the CPU when I reload fail2ban and sometimes mid day as well the CPU goes very high. I remember a while ago I was told to switch to systemd, any idea on how to do it?
2
votes
1answer
495 views

fail2ban with iptables-persistent

I've been running fail2ban for a bit, and recently installed iptables-persistent and am using it with ipset for a blacklist (there's one particular IP that is always hammering away at this machine). ...
1
vote
2answers
729 views

Fail2ban, jail.conf not exist

I installed Fail2ban to my debian, but I haven't jail.conf file in /etc/fail2ban/. I have only: action.d, filter.d Where can I find jail.conf?
0
votes
1answer
139 views

Can't install fail2ban on CentOS 6.9

I can't install fail2ban on my CentOS 6.9. Here is my config # cat /etc/*release CentOS release 6.9 (Final) CentOS release 6.9 (Final) CentOS release 6.9 (Final) # rpm -q epel-release epel-release-...
0
votes
1answer
224 views

Fail2ban Jail List

Recently our website starting loading extremely slow when browsing publicly to FDQN. Using IP of the website it will load the main file, but not dependencies. Curl show the TCP exchange happen in a ...
4
votes
2answers
2k views

creating an alternate jail in fail2ban for manual banning

I have a fail2ban instance that works well. But I also like to occasionally examine the logs manually and try to ID system probes that are working around my standard f2b definitions. What I'm ...
2
votes
2answers
4k views

How to use fail2ban to ban all php and cgi-bin requests

On daily basis I see Apache log full of requests initiated by different vulnerability scanner apps. Those hundreds of requests from usually same IP addresses not only makes the log dirty but also uses ...
0
votes
1answer
101 views

Facing huge layer 7 attack on port 3306

I am facing huge attack of layer 7 on port 3306- my iptables rules are good too 184 9568 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 flags:0x17/0x02 #...
0
votes
1answer
306 views

fail2ban fails 2 ban login attemps to smtp (postfix) server in docker container

I got a problem with my host / docker setting as follows: Host runs fail2ban, which accesses the mail.log files from the docker container, which are mapped over a volume. This all works fine, I ...
0
votes
1answer
152 views

Run fail2ban-regex by piping with zcat?

Normally running the command would go like this: $ fail2ban-regex /var/log/ningx/access.log \ /etc/fail2ban/filter.d/nginx-noscript.conf -v However, I have multiple files that I'd like to parse ...
0
votes
1answer
973 views

Fail2Ban with DDWRT or router

How can I use fail2ban with DDWRT or a router? I love using fail2ban, but there is no info about using fail2ban in a linux base ddwrt / optware / entware and so on.
1
vote
1answer
679 views

Fail2Ban custom filter not applied

I tried to create a custom jail rule in fail2ban, but it never gets applied. I did not find such an official documentation, I might miss something. /etc/fail2ban/filter.d/expressjs.conf [...
4
votes
1answer
1k views

How does fail2ban protect against DDoS?

How does fail2ban protect against SSH DDoS attacks? What does it do in the case of a DDoS attack? And how does it determine if it is a DDoS? I am asking only about DDoS attacks. (I assume it really ...
4
votes
2answers
4k views

How can I teach fail2ban to detect and block attacks from a whole subnet?

I have correctly installed fail2ban in my machine, activating the rules for ssh, ssh-dos and recidive; it all works ok. Lately, I have seen an increasing patterns of repetitive attacks from ...