Questions tagged [fail2ban]
Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc.
80
questions
0
votes
1
answer
37
views
sshd LogLevel not working
there
Someday, my ubuntu(22.04) machine write auth.log too short.
Following auth.log can't recognize from fail2ban(sshd)
Mar 6 17:52:03 laphs sshd[13792]: pam_unix(sshd:auth): check pass; user ...
7
votes
1
answer
10k
views
Block badbot with fail2ban via user agents in access.log
How can I create a filter to block these with fail2ban?
476 Mozilla/5.0 (compatible; BLEXBot/1.0; +http://webmeup-crawler.com/)
892 ltx71 - (http://ltx71.com/)
5367 Mozilla/5.0 (...
13
votes
3
answers
12k
views
How do I tell if my brute force protection (fail2ban) is running?
I'm not sure if my fail2ban is running. How can I tell if it's currently running?
Also, how do I tell if it is even running on startup?
0
votes
0
answers
74
views
Fail2ban with lots of IPs in log
I have a VPS with Ubuntu 20.04 to run a Counterstrike source server and I'm experiencing a weird kind of attack on ssh (brute force?) I setup fail2ban and on the first day of server online a lot of ...
0
votes
1
answer
219
views
Fail2ban sshd rule is active but not working!
I used ubuntu 22.04 TLS.
sshd_config:
Port 9401
SyslogFacility AUTH
LogLevel VERBOSE
MaxAuthTries 3
/etc/fail2ban/jail.local:
[ssh-9401]
enabled = true
filter = sshd
logpath = /var/log/auth.log
...
2
votes
1
answer
371
views
Fail2Ban bans, iptables lists the block but connection is still not blocked
I am using Ubuntu 22.04 LTS and I am trying to prevent repeated connection attempts to our mail server using fail2ban. Fail2ban creates a proper entry in the iptables configuration, but the related IP ...
2
votes
1
answer
2k
views
Fail2ban will not start
I installed Fail2ban but i can start the service. Every time i get this Error:
systemctl status fail2ban
× fail2ban.service - ...
0
votes
0
answers
703
views
Using sendmail to send notifications (Fail2Ban) through Postfix relay
I'm still pretty much a complete neophyte when it comes to Ubuntu/Linux in general, but I'm familiar with how sending mail via SMTP works in general. So now I currently have two Ubuntu servers running ...
0
votes
0
answers
130
views
Easy Desktop Remote with Xubuntu, Android and Fail2ban protection
I have switched from Windows to Xubuntu 22.04 last days and now i am searching some easy setup for desktop remote. The years before I always used Windows RDP which was not so easy. Windows did not ...
0
votes
1
answer
756
views
Fail2ban needs restart before running on ubuntu 22.04
I am running since today fail2ban on ubuntu 22.04 with ipv6 and when i start ubuntu the logs says every time i booting:
2023-04-21 23:43:39,740 fail2ban.server [1662]: INFO
Shutdown in ...
-1
votes
2
answers
675
views
fail2ban not manipulate iptables
i googled some articles like"how to install fail2ban on ubuntu 20.04",
none of them mentioned my situation.
my env: new ubuntu 20.04 installation on vmware player.straight install fail2ban.
...
-1
votes
1
answer
267
views
blocking bot attacks ufw fail2ban
Im doing something dumb, or missing something. Can anyone spot it please?
I have a tplink archer C7 set to port forward from an external port to port 22 on my internal server for ssh. But I still see ...
0
votes
0
answers
40
views
How to monitor and protect machine
Recently I've been locked out of my Ubuntu as a precaution and was notified that my vps/dedi was used for DDoS attacks on other services within the host as well as outside the host.
I've been granted ...
0
votes
2
answers
506
views
Fail2Ban, ban all ip except for myself
I am trying to whitelist ONE ip (myself) from accessing a device via ssh. How do I ban ALL ip except myself (1 ip that i am using?)
Context: I saw there are 500 ip attacks yesterday, I just wanna make ...
0
votes
0
answers
720
views
Very high load even nothing is done
I have the below Ubuntu server hosted by a commercial hoster. The hoster says he has no clue.
Attached a screenshot from top where can be seen which processes are slowing down the server.
It's more or ...
0
votes
0
answers
249
views
Fail2Ban vulnerability after reboot
I am very happy with fail2ban for protecting my server except for one issue. After a reboot, each banned ip address is added to iptables one at a time. On one server, I have about 7500 permanently ...
-1
votes
1
answer
473
views
Help to make a fail2ban filter
I've already done some filters for my fail2ban, but just simple things, like:
[Definition]
failregex = ^ .* "GET .*/wp-login.php
ignoreregex =
i don't use wordpress on my server, so i block a ...
0
votes
1
answer
235
views
Help to complete a script (fake google IPs, maybe fail2ban)
I monitored the google ip that accessed my server for a few years and identified these masks: 66.249.64.0/19 66.102.0.0/20 64.233.160.0/19 34.64.0.0/10 216.58.192.0/19 74.125.0.0/16
Then I created ...
0
votes
1
answer
2k
views
How to configure fail2ban for both TCP and UDP port?
I want to ban some DNS requests coming to my named server. The server normally listens both TCP and UDP port 53 and logs the requests to /var/log/named/query.log file. So, I added the following entry ...
2
votes
1
answer
1k
views
Fail2ban - IP banned is able to connect
I am using Ubuntu Server 20.04.
I installed fail2ban and it is correctly banning the IP but still its able to connect. Giving below the fail2ban.log snippet.
2021-07-19 09:52:14,543 fail2ban.filter ...
0
votes
0
answers
696
views
SSH timing out - no longer able to access server after installing Fail2ban
I decided to improve security on my Ubuntu 20.04 server by installing fail2ban. Looks like I went too far :/
I was previously logging in fine using SSH.
I installed a default fail2ban install, copied ...
0
votes
1
answer
731
views
Fail2ban is not able to connect to mysql under reboot prosess, both shutdown and startup process, Can't connect to MySQL server on '127.0.0.1' (111)
I'm running a LAMP setup on Ubuntu 18.04.5 LTS (GNU/Linux 4.15.0-135-generic x86_64).
I have integrated fail2ban and db using documentation from https://docs.iredmail.org/fail2ban.sql.html#fail2ban-...
3
votes
0
answers
11k
views
How to solve ssh error "ssh_exchange_identification: read: Connection reset by peer" on ubuntu server correctly
Related very closely to question and answers like:
How to fix "ssh_exchange_identification: read: Connection reset by peer" error?
My reputation is too low to comment or provide answer ...
3
votes
0
answers
3k
views
"top" shows fail2ban and sshd at the very top, hogging CPU usage
top shows fail2ban and sshd at the very top and hogging CPU usage.
top - 19:30:57 up 1 day, 9:44, 1 user, load average: 41.03, 41.02, 41.02
Tasks: 738 total, 1 running, 737 sleeping, 0 stopped, ...
0
votes
0
answers
152
views
Can't block specific IP address with iptables, Ubuntu 16.04
I'm trying to troubleshoot Fail2ban recognizing our http-get-dos trigger, but not actually banning the offending host. I can see it adding entries to iptables rules, but they don't have any affect.
So ...
4
votes
2
answers
4k
views
Fail2Ban regex SSH will not match auth.log
I'm trying to get Fail2Ban to work with the SSHD config provided.
When I run:
fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf
The output is:
root@fw:/etc/fail2ban/filter.d# ...
0
votes
1
answer
563
views
Fail2ban doesn't persist manual banned IPs after service restart
Just upgraded from f2b v0.9.6 to v0.10.5 on Ubuntu 14.04 using this thread, and it is banning normally according to my old jails that i copied from my previous version.
But when i restart the service,...
1
vote
0
answers
226
views
Fail2ban continuous log flood, what's happening?
A couple of days ago I noticed my server got very sluggish. When I investigated I noticed fail2ban was going crazy, the fail2ban-server process taking up 50% of CPU, and the fail2ban log file is ...
5
votes
2
answers
20k
views
Fail2ban Error on start
Recently, I have tried restarting Fail2ban and I have received an error, making it impossible to start... The full error I received from systemctl status fail2ban is as follows:
Jan 03 18:27:02 ...
3
votes
1
answer
3k
views
How to prevent x11vnc attacks: attempts to unauthorized logins?
My computer was freezing for 1 second every 5 seconds.
I found it was someone repeatedly trying to log in through x11vnc.
Is there some way I can have it reject connections from an IP address for a ...
17
votes
2
answers
3k
views
IP getting access even after blocking
78.128.113.62 - - [04/Jan/2020:19:59:33 +0530] "GET /efk-dashboard HTTP/1.1" 404 66914 "-" "python-requests/2.13.0"
There are multiple access records like this even after I have run the commands
ufw ...
0
votes
0
answers
2k
views
Fail2ban not sending email
I set up Fail2ban as per this page: https://help.ubuntu.com/community/Fail2ban
I tried looking in several pages among others:
https://stackoverflow.com/questions/25890510/fail2ban-not-sending-email-...
0
votes
0
answers
626
views
fail2ban banned IP still able to connect
Having trouble with Fail2ban:
Background:
Using Ubuntu Server 18.04.2
Installed ufw
Installed and set up ssh with keys, random port other than 22, working
Installed fail2ban
Issue:
On same LAN ...
5
votes
1
answer
1k
views
How should I write the fail2ban -> apache-badbots.conf rules?
I often have to add new rules to the apache-badbots.conf file, and every time I have the doubt that it no longer works...
For example, this is my current apache-badbots.conf file:
[Definition]
...
1
vote
0
answers
1k
views
ssh, fail2ban and max login attempts
I am testing fail2ban in a Ubuntu 18.04 LTS server in VirtualBox.
I set maxretry = 3 in /etc/fail2ban/jail.local, and I tried to ssh connect from another virtual machine with a wrong password. After ...
1
vote
1
answer
2k
views
Fail2ban Dynamic IP
I need help setting up my Fail2ban. I have a client that your IP is Dynamic.
and every time I need to wait for it to tell me the IP so I can include ignoreip.
How can i make a script to collect if ...
2
votes
1
answer
6k
views
Job for fail2ban.service failed because the control process exited with error
I have a basic issue on getting fail2ban started on one of my machines. I have a machine with Ubuntu 16.04 freshly installed today, and I am following a variety of instructions on fail2ban from source ...
4
votes
1
answer
3k
views
fail2ban actions to broaden the banned IP range
Is there a way to have fail2ban ban the entire class C network from which a ban address comes from?
A
0
votes
1
answer
1k
views
Regex for fail2ban config file to match pregreet lines in mail.log
The lines in mail.log to match are like:
May 6 10:06:16 mikes-serverbox postfix/postscreen[15486]: PREGREET 14 after 0.1 from [173.225.99.104]:57130: EHLO ylmf-pc\r\n
May 9 11:36:36 mikes-...
6
votes
4
answers
13k
views
Fail2ban fails to start after update?
I have been using fail2ban for a while on my Ubuntu server. Recently (after upgrading to ubuntu 15.04 I assume) fail2ban has been failing to start.
Initially, this was because the port option had ...
1
vote
0
answers
307
views
Block IP:s recognized by logwatch using fail2ban+ufw?
I got fail2ban and logwatch running on my server. Each day I have a few IP:s that's been probing my server and also a few "Attempts to use known hacks", as it states in the daily mail.
I would like ...
0
votes
0
answers
273
views
fail2ban duplicate log entries
I am posing this as a question....
It seems every time I restart fail2ban it re-bans all the IP addresses and possibly creates a new log entry for every previous ban.
I pipe every ban to a text file ...
3
votes
0
answers
682
views
What do the filters included in Fail2ban?
In my /filter.d/ directory of Fail2ban there are many filters.
3proxy.conf asterisk.conf ejabberd-auth.conf lighttpd-auth.conf oracleims.conf selinux-...
1
vote
3
answers
4k
views
Unable to install fail2ban on Ubuntu 16.04 LTS server!
I installed a new Ubuntu 16.04 LTS server.
I want to protect it with fail2ban, but when I try to install the package I get an error.
How do I resolve this problem?
> apt-get install fail2ban
...
5
votes
2
answers
11k
views
Job for fail2ban.service failed because the control process exited with error code
I have installed fail2ban on my server (OS: Ubuntu 16.0.4 LTS). When I try to start it, I get the following error message:
Job for fail2ban.service failed because the control process exited with ...
1
vote
1
answer
92
views
Fail2ban ignoreip command crashing fail2ban
Recently I updated ubuntu 16.04 with the latest security updates and all of a sudden ignoreip stops fail2ban from running
I comment this line out and it starts working
Any ideas? i tried adding commas ...
10
votes
5
answers
14k
views
Fail2Ban or DenyHosts to block invalid username SSH login attempts
Is there a way to automatically block IP address when a user tries to login as any invalid username? I already have:
[ssh]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
...
51
votes
5
answers
232k
views
vivid - failed to connect to upstart: connection refused
Just updated via do-release-upgrade and now certain upstart jobs such as fail2ban and plexmediaserver will not start (have tried reinstalling)
$ sudo service fail2ban start
Job for fail2ban.service ...
4
votes
2
answers
8k
views
What are fail2ban's log iptables "returned NNN" entries? (Fail2ban is failing to ban)
In my fail2ban.log there are some entries the meaning of which I don't understand (and haven't found searching around)...
I have several "jails", and I have created one particular one that bans IP's ...
1
vote
1
answer
2k
views
Fail2Ban not banning
Fail2Ban works fine with the built-in jails, but my custom OpenVPN jail doesn't ban anything, neither does my NGINX-DoS jail. The output of sudo fail2ban-client status openvpn is:
Status for the jail:...