Questions tagged [fail2ban]

Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc.

33 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3 votes
0 answers
11k views

How to solve ssh error "ssh_exchange_identification: read: Connection reset by peer" on ubuntu server correctly

Related very closely to question and answers like: How to fix "ssh_exchange_identification: read: Connection reset by peer" error? My reputation is too low to comment or provide answer ...
mhack's user avatar
  • 31
3 votes
0 answers
3k views

"top" shows fail2ban and sshd at the very top, hogging CPU usage

top shows fail2ban and sshd at the very top and hogging CPU usage. top - 19:30:57 up 1 day, 9:44, 1 user, load average: 41.03, 41.02, 41.02 Tasks: 738 total, 1 running, 737 sleeping, 0 stopped, ...
user14045797's user avatar
3 votes
0 answers
682 views

What do the filters included in Fail2ban?

In my /filter.d/ directory of Fail2ban there are many filters. 3proxy.conf asterisk.conf ejabberd-auth.conf lighttpd-auth.conf oracleims.conf selinux-...
alebal's user avatar
  • 463
3 votes
0 answers
1k views

fail2ban: how to immediately ban those who attempt ssh userid logins

My OpenSSH server is set up to only allow key based logins. I get many attacks each day from bots trying to login using a userid and password. I have fail2ban configured and running already. How can I ...
Organic Marble's user avatar
2 votes
1 answer
371 views

Fail2Ban bans, iptables lists the block but connection is still not blocked

I am using Ubuntu 22.04 LTS and I am trying to prevent repeated connection attempts to our mail server using fail2ban. Fail2ban creates a proper entry in the iptables configuration, but the related IP ...
Deckard's user avatar
  • 123
2 votes
1 answer
2k views

Fail2ban will not start

I installed Fail2ban but i can start the service. Every time i get this Error: systemctl status fail2ban × fail2ban.service - ...
LogiX's user avatar
  • 21
1 vote
0 answers
226 views

Fail2ban continuous log flood, what's happening?

A couple of days ago I noticed my server got very sluggish. When I investigated I noticed fail2ban was going crazy, the fail2ban-server process taking up 50% of CPU, and the fail2ban log file is ...
Pantalaimon's user avatar
1 vote
0 answers
1k views

ssh, fail2ban and max login attempts

I am testing fail2ban in a Ubuntu 18.04 LTS server in VirtualBox. I set maxretry = 3 in /etc/fail2ban/jail.local, and I tried to ssh connect from another virtual machine with a wrong password. After ...
Asarluhi's user avatar
  • 1,597
1 vote
0 answers
307 views

Block IP:s recognized by logwatch using fail2ban+ufw?

I got fail2ban and logwatch running on my server. Each day I have a few IP:s that's been probing my server and also a few "Attempts to use known hacks", as it states in the daily mail. I would like ...
Daniel Holm's user avatar
1 vote
0 answers
955 views

can't set up fail2ban Ubuntu 16.04

I run: sudo apt-get update sudo apt-get install fail2ban sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local With out activating any jails or anything else: sudo systemctl restart fail2ban ...
newcat1000's user avatar
  • 1,442
1 vote
0 answers
773 views

Fail2ban Not banning IP Address

I am using this jail in /etc/fail2ban/jail.local: [nginx-bots] enabled = true port = http,https filter = nginx-bots logpath = /var/log/nginx/access.log* maxretry = 1 bantime = 172800 ...
JoaMika's user avatar
  • 135
1 vote
0 answers
803 views

Ubuntu Server 16.04 - Errors were encountered while processing fail2ban

When I try to install fail2ban on my Ubuntu Server 16.04 apt-get -install fail2ban I am getting error message: "Errors were encountered while processing fail2ban" I've tried unninstall fail2ban with ...
Dogomen's user avatar
  • 43
0 votes
1 answer
37 views

sshd LogLevel not working

there Someday, my ubuntu(22.04) machine write auth.log too short. Following auth.log can't recognize from fail2ban(sshd) Mar 6 17:52:03 laphs sshd[13792]: pam_unix(sshd:auth): check pass; user ...
booraik's user avatar
0 votes
0 answers
74 views

Fail2ban with lots of IPs in log

I have a VPS with Ubuntu 20.04 to run a Counterstrike source server and I'm experiencing a weird kind of attack on ssh (brute force?) I setup fail2ban and on the first day of server online a lot of ...
rodrigtti's user avatar
0 votes
0 answers
705 views

Using sendmail to send notifications (Fail2Ban) through Postfix relay

I'm still pretty much a complete neophyte when it comes to Ubuntu/Linux in general, but I'm familiar with how sending mail via SMTP works in general. So now I currently have two Ubuntu servers running ...
G_Hosa_Phat's user avatar
0 votes
0 answers
130 views

Easy Desktop Remote with Xubuntu, Android and Fail2ban protection

I have switched from Windows to Xubuntu 22.04 last days and now i am searching some easy setup for desktop remote. The years before I always used Windows RDP which was not so easy. Windows did not ...
user6266369's user avatar
0 votes
1 answer
757 views

Fail2ban needs restart before running on ubuntu 22.04

I am running since today fail2ban on ubuntu 22.04 with ipv6 and when i start ubuntu the logs says every time i booting: 2023-04-21 23:43:39,740 fail2ban.server [1662]: INFO Shutdown in ...
user6266369's user avatar
0 votes
0 answers
40 views

How to monitor and protect machine

Recently I've been locked out of my Ubuntu as a precaution and was notified that my vps/dedi was used for DDoS attacks on other services within the host as well as outside the host. I've been granted ...
Nemanja Rankovic's user avatar
0 votes
0 answers
720 views

Very high load even nothing is done

I have the below Ubuntu server hosted by a commercial hoster. The hoster says he has no clue. Attached a screenshot from top where can be seen which processes are slowing down the server. It's more or ...
Peter VARGA's user avatar
0 votes
0 answers
249 views

Fail2Ban vulnerability after reboot

I am very happy with fail2ban for protecting my server except for one issue. After a reboot, each banned ip address is added to iptables one at a time. On one server, I have about 7500 permanently ...
Rick's user avatar
  • 1
0 votes
1 answer
2k views

How to configure fail2ban for both TCP and UDP port?

I want to ban some DNS requests coming to my named server. The server normally listens both TCP and UDP port 53 and logs the requests to /var/log/named/query.log file. So, I added the following entry ...
FedKad's user avatar
  • 10.4k
0 votes
0 answers
697 views

SSH timing out - no longer able to access server after installing Fail2ban

I decided to improve security on my Ubuntu 20.04 server by installing fail2ban. Looks like I went too far :/ I was previously logging in fine using SSH. I installed a default fail2ban install, copied ...
atjb's user avatar
  • 11
0 votes
1 answer
731 views

Fail2ban is not able to connect to mysql under reboot prosess, both shutdown and startup process, Can't connect to MySQL server on '127.0.0.1' (111)

I'm running a LAMP setup on Ubuntu 18.04.5 LTS (GNU/Linux 4.15.0-135-generic x86_64). I have integrated fail2ban and db using documentation from https://docs.iredmail.org/fail2ban.sql.html#fail2ban-...
grindstr's user avatar
0 votes
0 answers
152 views

Can't block specific IP address with iptables, Ubuntu 16.04

I'm trying to troubleshoot Fail2ban recognizing our http-get-dos trigger, but not actually banning the offending host. I can see it adding entries to iptables rules, but they don't have any affect. So ...
Joe Miller's user avatar
0 votes
0 answers
2k views

Fail2ban not sending email

I set up Fail2ban as per this page: https://help.ubuntu.com/community/Fail2ban I tried looking in several pages among others: https://stackoverflow.com/questions/25890510/fail2ban-not-sending-email-...
brat's user avatar
  • 101
0 votes
0 answers
626 views

fail2ban banned IP still able to connect

Having trouble with Fail2ban: Background: Using Ubuntu Server 18.04.2 Installed ufw Installed and set up ssh with keys, random port other than 22, working Installed fail2ban Issue: On same LAN ...
brat's user avatar
  • 101
0 votes
1 answer
1k views

Regex for fail2ban config file to match pregreet lines in mail.log

The lines in mail.log to match are like: May 6 10:06:16 mikes-serverbox postfix/postscreen[15486]: PREGREET 14 after 0.1 from [173.225.99.104]:57130: EHLO ylmf-pc\r\n May 9 11:36:36 mikes-...
viDim's user avatar
  • 23
0 votes
0 answers
273 views

fail2ban duplicate log entries

I am posing this as a question.... It seems every time I restart fail2ban it re-bans all the IP addresses and possibly creates a new log entry for every previous ban. I pipe every ban to a text file ...
User6655's user avatar
  • 106
0 votes
1 answer
1k views

UFW is not blocking IPs

so im working with fail2ban, ufw, and wordpress (NGINX). I made plugin for creating 401 if someone fail to login function wp_login_failed_403_res() { status_header(403); } add_action( '...
NoobyAFK's user avatar
  • 101
0 votes
0 answers
3k views

Protect Samba with fail2ban?

I know this isn't the smartest idea, but I use an ssh tunnel to forward samba to my raspberry pi NAS from my server. How can I protect samba against brute force attempts? I couldn't get fail2ban to ...
user8292439's user avatar
  • 3,798
0 votes
0 answers
258 views

Unable to connect to SSH / Network issue

I know the information I'm providing is very limited but I lost SSH connection to my Ubuntu Mate (Odroid XU4). I tried from different hosts, same issue, I also have very limited torrent connection ...
Kevin's user avatar
  • 165
0 votes
0 answers
75 views

Constantly getting banned from servers when I try to SSH and/or login

We are using fail2banin our servers, and I'm getting banned randomly from them, even if I log in successfully, after typing some chars I get banned. Also, when I do scp, it sometimes starts copying ...
JorgeeFG's user avatar
  • 1,996
-1 votes
1 answer
473 views

Help to make a fail2ban filter

I've already done some filters for my fail2ban, but just simple things, like: [Definition] failregex = ^ .* "GET .*/wp-login.php ignoreregex = i don't use wordpress on my server, so i block a ...
alebal's user avatar
  • 463