Questions tagged [fail2ban]

anti-bruteforcing daemon that works on connection attempts to services such as SSH

Filter by
Sorted by
Tagged with
15
votes
1answer
29k views

Installing fail2ban on CentOS 7

I am using @GarethTheRed 's answer to this question to install fail2ban on a remote CentOS 7 server. I am able to complete all the steps up until tail -f /var/log/fail2ban.log, at which point I get ...
10
votes
8answers
38k views

Delete all fail2ban bans in Ubuntu Linux

How can I delete all fail2ban bans in Ubuntu? I tried everything but I don't get it. I just want to delete all bans - but I don't know any IP adresses.
8
votes
1answer
11k views

Ignore a specific ip for fail2ban

I am using fail2ban with ipfw on FreeBSD. Is there a way to ignore a specific ip address, making sure that fail2ban never blocks or reports it?
7
votes
4answers
8k views

How to configure fail2ban with systemd journal?

I've install fail2ban on Debian Jessie LXC container, currently it's failing due to: Starting authentication failure monitor: fail2ban ERROR No file(s) found for glob /var/log/auth.log ERROR Failed ...
6
votes
2answers
5k views

How does fail2ban detect the time of an intrusion attempt if the log files don't have timestamp?

I know how to user fail2ban and how to configure a jail, but I'm not comfortable about how it actually works. The thing is, there's a particular jail option that pique my curiosity: findtime. When I ...
6
votes
4answers
5k views

Memory consumption Fail2Ban CentOS

Fail2Ban is using a huge amount of memory on my system (1.2 GB). There are several articles which describe how to reduce it. Below is an example for Debian. append the 1ulimit1 command to /etc/...
5
votes
1answer
3k views

Fail2ban-Regex test always tells no host in group [closed]

I'm trying to build a filter myself using regex. This is a line i want to filter for example: Aug 30 11:07:38 *** postfix/smtpd[17969]: connect from vps10685425.123-vps.co.uk[46.32.239.160] An this ...
4
votes
2answers
2k views

creating an alternate jail in fail2ban for manual banning

I have a fail2ban instance that works well. But I also like to occasionally examine the logs manually and try to ID system probes that are working around my standard f2b definitions. What I'm ...
4
votes
1answer
852 views

How does fail2ban protect against DDoS?

How does fail2ban protect against SSH DDoS attacks? What does it do in the case of a DDoS attack? And how does it determine if it is a DDoS? I am asking only about DDoS attacks. (I assume it really ...
4
votes
2answers
4k views

How can I teach fail2ban to detect and block attacks from a whole subnet?

I have correctly installed fail2ban in my machine, activating the rules for ssh, ssh-dos and recidive; it all works ok. Lately, I have seen an increasing patterns of repetitive attacks from ...
4
votes
0answers
65 views

fail2ban too slow, banning after the attack

We had a "register"-attack to our voip server (freeswitch). In the Logs it looks something like this: 2019-04-25 14:35:16.137965 [WARNING] sofia_reg.c:1743 SIP auth failure (REGISTER) on sofia ...
3
votes
1answer
968 views

How to automatically permanently ban IP addresses?

Currently I have been using iptables on a new Debian server running Asterisk. Every day I have been checking auth.log for IP addresses and manually doing iptables -A INPUT -s IPA.DRE.SS.0/24 -j DROP ...
3
votes
2answers
574 views

Brute force attack on vsftp server not showing failed authentication in log

My server is running Debian 8 with vsftpd version 3.0.2-17. Recently my vsftpd.log filled up with the following: vsftpd.log Mon Mar 7 18:13:44 2016 [pid 13499] CONNECT: Client "::ffff:xxx.xxx.xx.xx"...
3
votes
1answer
4k views

Do I have thousands of attempts to breach my system in this log from logwatch?

I'm setting my systems up to send me reports by email. I'm posting one log report (see below). This log shows that there are thousands of attempted break-ins. Questions: I have denyhosts and ...
3
votes
1answer
2k views

Why does Fail2ban not send mail for one particular jail?

Fail2ban is doing it's job and fail2ban-client status is showing me they're all working fine and offending addresses get blocked. When an address is blocked I like to receive a mail. That's working ...
3
votes
1answer
1k views

fail2ban permission denied on script

I've just upgraded from RHEL 5 to 6.5 and setup fail2ban anew. I can't seem to get my custom action to work now, supposedly because of a permission issue. I wan't to know what am I doing wrong, and ...
3
votes
2answers
65 views

How to show “number of failed login attempts” on a successful ssh login?

I use CentOS 7 on a host. There used to be a report of the number of failed login attempts shown whenever I logged into the machine using SSH. The full banner was something like this: Last failed ...
3
votes
0answers
42 views

Why fail2ban would ban an IP that is whitelisted (on ignoreip)?

I have fail2ban configured to protect the authentication on a postfix service. The jail is working properly on the ban side, but the ignoreip option seems to be ignored or misconfigured since it bans ...
3
votes
0answers
831 views

Fail2Ban fails to ban!

I get a lot of IPs that try probing my sites so I set up a filter to ban them after a few 404 errors. But something is not working because I get a bunch of these instead: 2017-06-07 01:08:37,175 ...
3
votes
0answers
513 views

Nagios - Help with getting NRPE to work with check_fail2ban.sh

I am trying to monitor fail2ban with Nagios so, I found the following check via a Google search: http://nagios.fm4dd.com/plugins/manual/check_fail2ban.htm I am trying to get the check to work on a ...
3
votes
0answers
797 views

what is the correct regexp for mysql filter in fail2ban?

I use the default filter file /etc/fail2ban/filter.d/mysqld-auth.conf for fail2ban service. But there are some errors in file /var/log/fail2ban.log as: Found a match for '150815 10:42:54 [Warning] ...
3
votes
0answers
1k views

Server freezes because of fail2ban

Lately I've experienced some problems with my server freezing or having network problems (I can't really tell which at this point). I'm running OpenSSH on port 443 and it seems fail2ban's anti SSH ...
2
votes
2answers
8k views

fail2ban is running but no fail2ban.log log file exists for it

I've set up fail2ban on a centos VPS used for a few mail accounts among other things and want to check that everything is running smoothly. According to fail2ban-client status everything is running as ...
2
votes
2answers
4k views

How to use fail2ban to ban all php and cgi-bin requests

On daily basis I see Apache log full of requests initiated by different vulnerability scanner apps. Those hundreds of requests from usually same IP addresses not only makes the log dirty but also uses ...
2
votes
1answer
374 views

What are these %(…)s strings in fail2ban's jail.conf file, and how do they work?

In setting up fail2ban there are what appear to be variables at the top of the jail.conf that look like this: mytime=300 . . . [ssh] bantime=%(mytime)s Or in this more complicated form like this: ...
2
votes
1answer
809 views

Fail2ban - send email with msmtp

How do I set up fail2ban to send emails using msmtp? I tried changing the mta = sendmail line to mta = msmtp and the action = %(action_)s line to action = %(action_mwl)s. I think /etc/fail2ban/...
2
votes
1answer
936 views

Server login attempts NOT blocked after configuring fail2ban

So, I installed (and configured) fail2ban on three Ubuntu VPS servers. I configured (imo) a maximum of 3 failed login attempts (via Putty as root) within 2 minutes. Then I restarted the fail2ban ...
2
votes
1answer
331 views

Does it exist a fail2ban alternative in official Centos repository?

If I don't want to add other repository (EPEL for example) than the official ones that are coming with a fresh CentOS install, is there a more official alternative than fail2ban?
2
votes
1answer
2k views

Fail2Ban monitor HTPasswd/HTAccess

So i tried putting this in jail.local and restarting fail2ban but no go. [apache] enabled = true port = https filter = apache-auth logpath = /var/log/apache*/*error.log maxretry = 5 [apache] ...
2
votes
1answer
2k views

Fail2ban is not blocking IPs trying to access my server via ssh

I installed fail2ban with the default settings because there's a bunch of bots trying to log in as root to my server. I installed it but nothing has changed, I checked fail2ban jail IP list and there'...
2
votes
1answer
2k views

fail2ban not working

I have several services running on my Ubuntu 12.04 server and set up fail2ban, but it doesn't block the attacking IPs. SSH is running on port 22. jail.conf [DEFAULT] bantime = 600 maxretry = 3 ...
2
votes
1answer
191 views

mosquitto bruteforce fail2ban failregex

I am trying to write fail2ban filter to block bruteforcing IP addresses which are trying to subscribe to username/password protected mosquitto service by guessing username/password combinations. On ...
2
votes
1answer
1k views

fail2ban works fine on bad SSH attempts, but fails on bad Apache2 attempts

I'm running Debian Linux. uname --all shows: Linux xxx.xx 2.6.32-5-686 #1 SMP Tue May 13 16:33:32 UTC 2014 i686 GNU/Linux I'm running sshd on a port that is not 22. I've updated /etc/fail2ban/jail....
2
votes
0answers
257 views

Fail2ban for nginx post flood ignores time intervals

I'm trying to create a fail2ban filter that is going to ban the host when it sends over 100 POST requests over 30 seconds interval. jail.local: [nginx-postflood] enabled = false filter = nginx-...
2
votes
1answer
2k views

Fail2Ban fails to start on CentOS 7

I'm running CentOS 7, all fully updated, and am trying to get Fail2Ban to work, but I'm running into problems. Specifically, I'm trying to block brute force SSH attacks. I'm pretty sure I've set up ...
1
vote
1answer
72 views

Why are there both printf and print in this command?

While studying about fail2ban I came across this command. I never worked with awk before, only with sed. I don't understand why there are both printf and print, there: awk '{ printf "# "; print; }' /...
1
vote
1answer
200 views

Is this what it looks like in the terminal on the client side when you are blocked out via fail2ban?

I am a new server admin. I just setup fail2ban on an ubuntu 12.04 VPS. I used this tutorial. Then I tried to login to the system via ssh from a friend's machine. It is showing "operation timed out." ...
1
vote
3answers
1k views

fail2ban keeps saying already banned but it didn't actually ban

I just configured a new server and installed fail2ban as well, but it is not banning me when I keep trying to connect with the wrong password fail2ban.log: 2018-03-23 12:46:29,363 fail2ban.actions ...
1
vote
3answers
2k views

Restore original fail2ban configuration on CentOS 7

I installed fail2ban from EPEL using yum install, and then proceeded to screw up the configuration after forgetting to back up /etc/fail2ban. Now I want the original configuration back. First I ...
1
vote
1answer
1k views

fail2ban ip blocked, yet still login attempts

everything seems ok, iptables shows its blocked, yet I still get auth attempts I have configured fail2ban # "ignoreip" can be an IP address, a CIDR mask or a DNS host ignoreip = 127.0.0.1/8 bantime ...
1
vote
1answer
625 views

Fail2Ban custom filter not applied

I tried to create a custom jail rule in fail2ban, but it never gets applied. I did not find such an official documentation, I might miss something. /etc/fail2ban/filter.d/expressjs.conf [...
1
vote
1answer
2k views

Block ESTABLISHED connections with firewalld/iptables

I am running firewalld on my server and I am trying to setup a fail2ban (using firewalld) in order to improve security. The problem is: I can't get it to kill established connections. Firewalld has ...
1
vote
1answer
1k views

How to use Fail2Ban to protect ProxyPass(ed) applications

So I recently configured an application that uses WebSockets and I am using Apache proxy pass to pass on the application via domain.com/application The problem is the application is very bare metal. ...
1
vote
1answer
145 views

fail2ban has banned my Ip but I can still login using SSH

I done a fresh new install of fail2ban on a Debian 9.8 I copied /etc/fail2ban/jail.conf as jail.local. And in my jail.local in added enabled=true under [ssh] Tailing fail2ban's log I can see what ...
1
vote
1answer
346 views

How to configure fail2ban email destination globally

I'd like fail2ban to send me alert emails for any events. There seem to be dest variables littered throughout the config files in /etc/fail2ban and /etc/fail2ban/action.d Is there a way to set one ...
1
vote
2answers
658 views

Fail2ban, jail.conf not exist

I installed Fail2ban to my debian, but I haven't jail.conf file in /etc/fail2ban/. I have only: action.d, filter.d Where can I find jail.conf?
1
vote
2answers
1k views

Why do iptables drop / log even if the appropriate packet should be accepted?

I'm setting up a server running Debian Jessie with some applications like iptables firewall, fail2ban, openvpn, apache, ... The iptables firewall is configured in the way, that it logs every packet ...
1
vote
0answers
19 views

fail2ban not detecting ssh failures on CentOS 7

I've installed fail2ban on CentOS 7 and added jail.local: [sshd] enabled = true When I try a bad ssh login, I get a log entry in /var/log/secure like this: Jun 5 11:09:40 arsenal sshd[32595]: ...
1
vote
0answers
21 views

fail2ban unexpectedly “starts” causing duplicate iptables entries and flushlogs running at 99% cpu [closed]

I've recently configured a Ubuntu16 server and I'm getting "fail2ban started" emails sent again even though the server did not restart. I noticed this has happened twice, both times the emails came in ...
1
vote
1answer
81 views

fail2ban will not ban again after first one expires

I couldn't make fail2ban to block IP address coming up in postfix log on Debian 9. I rewrote the failregex to be like this: NOQUEUE: reject: RCPT from (.*)\[<HOST>\]:(.*) 550 5.7.1 Service ...