Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc.

learn more… | top users | synonyms

0
votes
1answer
23 views

Fail2ban 0.9.0 enabling jails

I updated my server to 16.04 and it only installs fail2ban 0.9.0. There is no option to enable jails and when I add it manually it fails to load. Any help much appreciated.
0
votes
0answers
23 views

fail2ban: No section headers

Does someone knows what this means and how I can fix this? # fail2ban-regex sasl /var/log/mail.log Running tests ============= No section headers in /var/log/mail.log
2
votes
1answer
57 views

How do I permanently removing a ban stored by Fail2Ban

I have two filters that have banned local addresses. I have added the addresses to ignoreip but the damage was done already and the bans are in place. Every time I reboot my computer I have to do an ...
1
vote
0answers
59 views

fail2ban: how to immediately ban those who attempt ssh userid logins

My OpenSSH server is set up to only allow key based logins. I get many attacks each day from bots trying to login using a userid and password. I have fail2ban configured and running already. How can I ...
1
vote
1answer
72 views

fail2ban won't work

A few days ago I setup a new whole Server (Mailserver with Zarafa / Postfix, Apache, MySQL, and so on). Everything works fine.. except fail2ban. Fail2ban do nothing. He don't even act if something is ...
0
votes
0answers
21 views

Merging IPTABLES

In advance, thanks for all help! Hi. Got two ubuntu servers running fail2ban. I am currently trying to write a bash shell code to sync the iptables and / banned ips. So I got this rules from ...
0
votes
0answers
113 views

Fail2ban-regex filters not working in Nginx (returning Missed line(s): /var/log/nginx/access.log)

I've set up Fail2Ban on my Nginx Ubuntu 14.04 server following these instructions, which seem to have worked for most folks. When testing any of the filters that point to /var/log/nginx/access.log ...
0
votes
0answers
26 views

fail2ban is blocking several ips, more than normally

My fail2ban is blocking several ips, more than normally. I think is the same computer but is changing ip. How i can detect original name source. thanks Jane
0
votes
0answers
48 views

fail2ban log filling up whole disk and not deleting it properly

I logged in to a newly built server and I found out it was completely full. I checked the disk space taken by the files and I was puzzled to see that it was nowhere to be found. So I ran lsof +L1 to ...
0
votes
0answers
25 views

Where do you look to see IP's banned by fail2ban [duplicate]

fail2ban is running and I'd like to see those ips that are currently banned. Where is the list kept and is there a cmd to use specifically to see banned ips?
0
votes
1answer
680 views

Fail2ban not banning for my custom filter

I have created a new filter in fail2ban for my owncloud installation. When I tested it with fail2ban-regex it returned matches, so I figured it was working. When I turn it on in the jail however it ...
2
votes
2answers
2k views

Fail2ban fails to start after update?

I have been using fail2ban for a while on my Ubuntu server. Recently (after upgrading to ubuntu 15.04 I assume) fail2ban has been failing to start. Initially, this was because the port option had ...
17
votes
2answers
50k views

vivid - failed to connect to upstart: connection refused

Just updated via do-release-upgrade and now certain upstart jobs such as fail2ban and plexmediaserver will not start (have tried reinstalling) sudo service fail2ban start Job for fail2ban.service ...
0
votes
1answer
510 views

How can I get fail2ban to stop banning my Filezilla SFTP?

When I started with an Ubuntu home server, fail2ban was a lifesaver - alerting me to multiple attempts at unauthorized SSH access to my server. Recently, after moving to a way off port, the only ...
4
votes
1answer
4k views

How to easily secure Ubuntu Server [closed]

I'm in the process of learning how to manage a dedicated server. I currently have a server with Ubuntu 14.04. There will only be a game server installed on it, and fall2ban. I was wondering if you ...
3
votes
1answer
2k views

Fail2Ban Regex SSH Will not Match Auth.Log - Searched Everywhere for a Solution

Im trying to get Fail2Ban to work with the SSHD Config provided. When i run fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf The Output is as follows root@fw:/etc/fail2ban/...
4
votes
3answers
1k views

How do I tell if my brute force protection (fail2ban) is running?

I'm not sure if my fail2ban is running. How can I tell if it's currently running? Also, how do I tell if it is even running on startup?
7
votes
2answers
7k views

How do you view all of the banned IP's for Ubuntu 12.04 via the command line?

I can't seem to find a quick command to just view all the banned IP's on the server. Or is there a file I can just edit? I'm guessing fail2ban is the one that inputs all the IP's to ban. Where do I ...
2
votes
1answer
977 views

Why /var/log/auth.log is using diffrent timezone?

I've installed fail2ban on a Ubuntu box (14.04) but it didn't work correctly. As I tried to inspect the reason, I discovered that the timezone which is being used by the /var/log/auth.log file is ...
1
vote
1answer
1k views

fail2ban: Creating a custom action that gives parameters to script

I'm having a few problems to understand the workflow of fail2ban. My goal is the following action: name: pamysql used to: exec command with <name>, <failures>, <ip>, ... as ...
1
vote
1answer
762 views

Fail2Ban/IPTables & Pure-Ftpd

I have pure-ftpd running on web server with Fail2Ban. Fail2Ban is letting apache2 connections in but are denying any FTP connection from anything but local host. I have attempted to modify the jail....
0
votes
2answers
969 views

I can't start deluge with init.d with the ability to log

I try to set fail2ban to ban ip which mistype my password on the deluge-web interface, but I have a problem with the logging. I try to set deluge to log the errors according to this website: http://...
1
vote
4answers
6k views

Fail2Ban or DenyHosts to block invalid username SSH login attempts

Is there a way to automatically block IP address when a user tries to login as any invalid username? I already have: [ssh] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log ...
1
vote
1answer
659 views

Configure Fail2Ban with bash script

I'm trying to configure the /etc/fail2ban/jail.local config with an bash script. I was thinking to use sed and regular expression to change the sections I need. sed -i "s/^bantime = 600/bantime = $...
1
vote
1answer
4k views

fail2ban is not sending mail when it bans an ip!

I have configured fail2ban to send me a mail when it bans an IP, but it is not working. I get a message when the jails start and stop but nothing else . I am using ssmtp to send mail via Google Mail. ...
2
votes
1answer
3k views

fail2ban broken after dist upgrade

My fail2ban install is broken after a dist update. I have no idea why it stopped to work. The logfile is over weeks 0 byte. Even if I can see in my server logs that the client should be blocked. Here ...
2
votes
1answer
2k views

How to set fail2ban with apf?

I just installed fail2ban and the apf firewall. Those 2 seems to be not working together. Fail2ban have added some iptable rules but they are not working. When I issue /etc/init.d/iptables status it ...
18
votes
2answers
8k views

potential ufw and fail2ban conflicts

Will running both fail2ban and ufw cause problems? I noticed that fail2ban modifies iptables rules, but ufw already has a ton of iptables rules defined... so I'm not sure if fail2ban will mess these ...
1
vote
1answer
303 views

fail2ban doesn't match anything

I'm working on a new build of my FTP server and I can't get the ssh part of fail2ban to match anything. Manually checking with the regex command shows nothing. Pam and proftpd are working fine, just ...
3
votes
1answer
1k views

Fail2ban misses some relay attempts

I have some relay attempts like these in my mail.log (they total 281 connection attempts in less than 3 minutes): May 16 04:58:30 MyServer postfix/smtpd[18950]: connect from unknown[xx.yy.zzz.www] ...
3
votes
2answers
7k views

What are fail2ban's log iptables “returned NNN” entries? (Fail2ban is failing to ban)

In my fail2ban.log there are some entries the meaning of which I don't understand (and haven't found searching around)... I have several "jails", and I have created one particular one that bans IP's ...