Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc.

learn more… | top users | synonyms

0
votes
1answer
37 views

Locked out of my server [closed]

I've been logging into my server all day using a keyfile I generated, I had no issues at all. Just now I was running a shellscript when my internet got disconnected. As soon as I got signal again I ...
0
votes
1answer
24 views

fail2ban: Creating a custom action that gives parameters to script

I'm having a few problems to understand the workflow of fail2ban. My goal is the following action: name: pamysql used to: exec command with <name>, <failures>, <ip>, ... as ...
1
vote
1answer
83 views

Fail2Ban/IPTables & Pure-Ftpd

I have pure-ftpd running on web server with Fail2Ban. Fail2Ban is letting apache2 connections in but are denying any FTP connection from anything but local host. I have attempted to modify the ...
0
votes
0answers
142 views

Configuring fail2ban with ssmtp

How fail2ban and ssmtp should be configured so that I will get notification of banned IPs in my mailbox? I have installed ssmtp successfully and confirmed that it works from command line. However, I ...
1
vote
0answers
292 views

fail2ban block retry count always changes

As title mentions clearly, fail2ban block retry count always changes. I set all retry counts to 3; but sometimes it blocks me after 6 or 7 retries. How can set its behavior a constant value? I added ...
0
votes
2answers
314 views

I can't start deluge with init.d with the ability to log

I try to set fail2ban to ban ip which mistype my password on the deluge-web interface, but I have a problem with the logging. I try to set deluge to log the errors according to this website: ...
0
votes
3answers
2k views

fail2ban or denyhosts to block invalid username login attempts

Is there a way to automatically block IP address when a user tries to login as any invalid username? I already have: [ssh] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log ...
1
vote
1answer
195 views

Configure Fail2Ban with bash script

I'm trying to configure the /etc/fail2ban/jail.local config with an bash script. I was thinking to use sed and regular expression to change the sections I need. sed -i "s/^bantime = 600/bantime = ...
1
vote
1answer
1k views

fail2ban is not sending mail when it bans an ip!

I have configured fail2ban to send me a mail when it bans an IP, but it is not working. I get a message when the jails start and stop but nothing else . I am using ssmtp to send mail via Google Mail. ...
1
vote
1answer
999 views

fail2ban broken after dist upgrade

My fail2ban install is broken after a dist update. I have no idea why it stopped to work. The logfile is over weeks 0 byte. Even if I can see in my server logs that the client should be blocked. Here ...
1
vote
1answer
931 views

How to set fail2ban with apf?

I just installed fail2ban and the apf firewall. Those 2 seems to be not working together. Fail2ban have added some ipatble rules but they are not working. When I issue "/etc/init.d/iptables status" ...
7
votes
2answers
2k views

potential ufw and fail2ban conflicts

Will running both fail2ban and ufw cause problems? I noticed that fail2ban modifies iptables rules, but ufw already has a ton of iptables rules defined... so I'm not sure if fail2ban will mess these ...
1
vote
1answer
254 views

fail2ban doesn't match anything

I'm working on a new build of my FTP server and I can't get the ssh part of fail2ban to match anything. Manually checking with the regex command shows nothing. Pam and proftpd are working fine, just ...
3
votes
1answer
673 views

Fail2ban misses some relay attempts

I have some relay attempts like these in my mail.log (they total 281 connection attempts in less than 3 minutes): May 16 04:58:30 MyServer postfix/smtpd[18950]: connect from unknown[xx.yy.zzz.www] ...
3
votes
2answers
5k views

What are fail2ban's log iptables “returned NNN” entries? (Fail2ban is failing to ban)

In my fail2ban.log there are some entries the meaning of which I don't understand (and haven't found searching around)... I have several "jails", and I have created one particular one that bans IP's ...