Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc.

learn more… | top users | synonyms

0
votes
0answers
10 views

fail2ban: No section headers

Does someone knows what this means and how I can fix this? # fail2ban-regex sasl /var/log/mail.log Running tests ============= No section headers in /var/log/mail.log
2
votes
1answer
41 views

How do I permanently removing a ban stored by Fail2Ban

I have two filters that have banned local addresses. I have added the addresses to ignoreip but the damage was done already and the bans are in place. Every time I reboot my computer I have to do an ...
2
votes
2answers
1k views

Fail2ban fails to start after update?

I have been using fail2ban for a while on my Ubuntu server. Recently (after upgrading to ubuntu 15.04 I assume) fail2ban has been failing to start. Initially, this was because the port option had ...
0
votes
0answers
77 views

Fail2ban-regex filters not working in Nginx (returning Missed line(s): /var/log/nginx/access.log)

I've set up Fail2Ban on my Nginx Ubuntu 14.04 server following these instructions, which seem to have worked for most folks. When testing any of the filters that point to /var/log/nginx/access.log ...
1
vote
1answer
55 views

fail2ban won't work

A few days ago I setup a new whole Server (Mailserver with Zarafa / Postfix, Apache, MySQL, and so on). Everything works fine.. except fail2ban. Fail2ban do nothing. He don't even act if something is ...
17
votes
2answers
8k views

potential ufw and fail2ban conflicts

Will running both fail2ban and ufw cause problems? I noticed that fail2ban modifies iptables rules, but ufw already has a ton of iptables rules defined... so I'm not sure if fail2ban will mess these ...
2
votes
1answer
2k views

How to set fail2ban with apf?

I just installed fail2ban and the apf firewall. Those 2 seems to be not working together. Fail2ban have added some iptable rules but they are not working. When I issue /etc/init.d/iptables status it ...
1
vote
1answer
1k views

fail2ban: Creating a custom action that gives parameters to script

I'm having a few problems to understand the workflow of fail2ban. My goal is the following action: name: pamysql used to: exec command with <name>, <failures>, <ip>, ... as ...
1
vote
0answers
37 views

fail2ban: how to immediately ban those who attempt ssh userid logins

My OpenSSH server is set up to only allow key based logins. I get many attacks each day from bots trying to login using a userid and password. I have fail2ban configured and running already. How can I ...
0
votes
0answers
19 views

Merging IPTABLES

In advance, thanks for all help! Hi. Got two ubuntu servers running fail2ban. I am currently trying to write a bash shell code to sync the iptables and / banned ips. So I got this rules from ...
0
votes
0answers
25 views

fail2ban is blocking several ips, more than normally

My fail2ban is blocking several ips, more than normally. I think is the same computer but is changing ip. How i can detect original name source. thanks Jane
0
votes
0answers
38 views

fail2ban log filling up whole disk and not deleting it properly

I logged in to a newly built server and I found out it was completely full. I checked the disk space taken by the files and I was puzzled to see that it was nowhere to be found. So I ran lsof +L1 to ...
0
votes
0answers
25 views

Where do you look to see IP's banned by fail2ban [duplicate]

fail2ban is running and I'd like to see those ips that are currently banned. Where is the list kept and is there a cmd to use specifically to see banned ips?
1
vote
4answers
6k views

Fail2Ban or DenyHosts to block invalid username SSH login attempts

Is there a way to automatically block IP address when a user tries to login as any invalid username? I already have: [ssh] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log ...
0
votes
1answer
577 views

Fail2ban not banning for my custom filter

I have created a new filter in fail2ban for my owncloud installation. When I tested it with fail2ban-regex it returned matches, so I figured it was working. When I turn it on in the jail however it ...
12
votes
2answers
39k views

vivid - failed to connect to upstart: connection refused

Just updated via do-release-upgrade and now certain upstart jobs such as fail2ban and plexmediaserver will not start (have tried reinstalling) sudo service fail2ban start Job for fail2ban.service ...
0
votes
1answer
424 views

How can I get fail2ban to stop banning my Filezilla SFTP?

When I started with an Ubuntu home server, fail2ban was a lifesaver - alerting me to multiple attempts at unauthorized SSH access to my server. Recently, after moving to a way off port, the only ...
4
votes
3answers
1k views

How do I tell if my brute force protection (fail2ban) is running?

I'm not sure if my fail2ban is running. How can I tell if it's currently running? Also, how do I tell if it is even running on startup?
3
votes
1answer
4k views

How to easily secure Ubuntu Server [closed]

I'm in the process of learning how to manage a dedicated server. I currently have a server with Ubuntu 14.04. There will only be a game server installed on it, and fall2ban. I was wondering if you ...
2
votes
1answer
2k views

Fail2Ban Regex SSH Will not Match Auth.Log - Searched Everywhere for a Solution

Im trying to get Fail2Ban to work with the SSHD Config provided. When i run fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf The Output is as follows ...
3
votes
1answer
1k views

Fail2ban misses some relay attempts

I have some relay attempts like these in my mail.log (they total 281 connection attempts in less than 3 minutes): May 16 04:58:30 MyServer postfix/smtpd[18950]: connect from unknown[xx.yy.zzz.www] ...
6
votes
2answers
6k views

How do you view all of the banned IP's for Ubuntu 12.04 via the command line?

I can't seem to find a quick command to just view all the banned IP's on the server. Or is there a file I can just edit? I'm guessing fail2ban is the one that inputs all the IP's to ban. Where do I ...
1
vote
1answer
725 views

Fail2Ban/IPTables & Pure-Ftpd

I have pure-ftpd running on web server with Fail2Ban. Fail2Ban is letting apache2 connections in but are denying any FTP connection from anything but local host. I have attempted to modify the ...
1
vote
1answer
4k views

fail2ban is not sending mail when it bans an ip!

I have configured fail2ban to send me a mail when it bans an IP, but it is not working. I get a message when the jails start and stop but nothing else . I am using ssmtp to send mail via Google Mail. ...
0
votes
2answers
945 views

I can't start deluge with init.d with the ability to log

I try to set fail2ban to ban ip which mistype my password on the deluge-web interface, but I have a problem with the logging. I try to set deluge to log the errors according to this website: ...
1
vote
1answer
3k views

fail2ban broken after dist upgrade

My fail2ban install is broken after a dist update. I have no idea why it stopped to work. The logfile is over weeks 0 byte. Even if I can see in my server logs that the client should be blocked. Here ...
1
vote
1answer
633 views

Configure Fail2Ban with bash script

I'm trying to configure the /etc/fail2ban/jail.local config with an bash script. I was thinking to use sed and regular expression to change the sections I need. sed -i "s/^bantime = 600/bantime = ...
3
votes
2answers
7k views

What are fail2ban's log iptables “returned NNN” entries? (Fail2ban is failing to ban)

In my fail2ban.log there are some entries the meaning of which I don't understand (and haven't found searching around)... I have several "jails", and I have created one particular one that bans IP's ...
1
vote
1answer
303 views

fail2ban doesn't match anything

I'm working on a new build of my FTP server and I can't get the ssh part of fail2ban to match anything. Manually checking with the regex command shows nothing. Pam and proftpd are working fine, just ...