Questions tagged [fail2ban]
Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc.
33
questions with no upvoted or accepted answers
3
votes
0
answers
11k
views
How to solve ssh error "ssh_exchange_identification: read: Connection reset by peer" on ubuntu server correctly
Related very closely to question and answers like:
How to fix "ssh_exchange_identification: read: Connection reset by peer" error?
My reputation is too low to comment or provide answer ...
3
votes
0
answers
3k
views
"top" shows fail2ban and sshd at the very top, hogging CPU usage
top shows fail2ban and sshd at the very top and hogging CPU usage.
top - 19:30:57 up 1 day, 9:44, 1 user, load average: 41.03, 41.02, 41.02
Tasks: 738 total, 1 running, 737 sleeping, 0 stopped, ...
3
votes
0
answers
682
views
What do the filters included in Fail2ban?
In my /filter.d/ directory of Fail2ban there are many filters.
3proxy.conf asterisk.conf ejabberd-auth.conf lighttpd-auth.conf oracleims.conf selinux-...
3
votes
0
answers
1k
views
fail2ban: how to immediately ban those who attempt ssh userid logins
My OpenSSH server is set up to only allow key based logins. I get many attacks each day from bots trying to login using a userid and password. I have fail2ban configured and running already. How can I ...
2
votes
1
answer
371
views
Fail2Ban bans, iptables lists the block but connection is still not blocked
I am using Ubuntu 22.04 LTS and I am trying to prevent repeated connection attempts to our mail server using fail2ban. Fail2ban creates a proper entry in the iptables configuration, but the related IP ...
2
votes
1
answer
2k
views
Fail2ban will not start
I installed Fail2ban but i can start the service. Every time i get this Error:
systemctl status fail2ban
× fail2ban.service - ...
1
vote
0
answers
226
views
Fail2ban continuous log flood, what's happening?
A couple of days ago I noticed my server got very sluggish. When I investigated I noticed fail2ban was going crazy, the fail2ban-server process taking up 50% of CPU, and the fail2ban log file is ...
1
vote
0
answers
1k
views
ssh, fail2ban and max login attempts
I am testing fail2ban in a Ubuntu 18.04 LTS server in VirtualBox.
I set maxretry = 3 in /etc/fail2ban/jail.local, and I tried to ssh connect from another virtual machine with a wrong password. After ...
1
vote
0
answers
307
views
Block IP:s recognized by logwatch using fail2ban+ufw?
I got fail2ban and logwatch running on my server. Each day I have a few IP:s that's been probing my server and also a few "Attempts to use known hacks", as it states in the daily mail.
I would like ...
1
vote
0
answers
955
views
can't set up fail2ban Ubuntu 16.04
I run:
sudo apt-get update
sudo apt-get install fail2ban
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
With out activating any jails or anything else:
sudo systemctl restart fail2ban
...
1
vote
0
answers
773
views
Fail2ban Not banning IP Address
I am using this jail in /etc/fail2ban/jail.local:
[nginx-bots]
enabled = true
port = http,https
filter = nginx-bots
logpath = /var/log/nginx/access.log*
maxretry = 1
bantime = 172800
...
1
vote
0
answers
803
views
Ubuntu Server 16.04 - Errors were encountered while processing fail2ban
When I try to install fail2ban on my Ubuntu Server 16.04
apt-get -install fail2ban
I am getting error message: "Errors were encountered while processing fail2ban"
I've tried unninstall fail2ban with ...
0
votes
1
answer
37
views
sshd LogLevel not working
there
Someday, my ubuntu(22.04) machine write auth.log too short.
Following auth.log can't recognize from fail2ban(sshd)
Mar 6 17:52:03 laphs sshd[13792]: pam_unix(sshd:auth): check pass; user ...
0
votes
0
answers
74
views
Fail2ban with lots of IPs in log
I have a VPS with Ubuntu 20.04 to run a Counterstrike source server and I'm experiencing a weird kind of attack on ssh (brute force?) I setup fail2ban and on the first day of server online a lot of ...
0
votes
0
answers
705
views
Using sendmail to send notifications (Fail2Ban) through Postfix relay
I'm still pretty much a complete neophyte when it comes to Ubuntu/Linux in general, but I'm familiar with how sending mail via SMTP works in general. So now I currently have two Ubuntu servers running ...
0
votes
0
answers
130
views
Easy Desktop Remote with Xubuntu, Android and Fail2ban protection
I have switched from Windows to Xubuntu 22.04 last days and now i am searching some easy setup for desktop remote. The years before I always used Windows RDP which was not so easy. Windows did not ...
0
votes
1
answer
757
views
Fail2ban needs restart before running on ubuntu 22.04
I am running since today fail2ban on ubuntu 22.04 with ipv6 and when i start ubuntu the logs says every time i booting:
2023-04-21 23:43:39,740 fail2ban.server [1662]: INFO
Shutdown in ...
0
votes
0
answers
40
views
How to monitor and protect machine
Recently I've been locked out of my Ubuntu as a precaution and was notified that my vps/dedi was used for DDoS attacks on other services within the host as well as outside the host.
I've been granted ...
0
votes
0
answers
720
views
Very high load even nothing is done
I have the below Ubuntu server hosted by a commercial hoster. The hoster says he has no clue.
Attached a screenshot from top where can be seen which processes are slowing down the server.
It's more or ...
0
votes
0
answers
249
views
Fail2Ban vulnerability after reboot
I am very happy with fail2ban for protecting my server except for one issue. After a reboot, each banned ip address is added to iptables one at a time. On one server, I have about 7500 permanently ...
0
votes
1
answer
2k
views
How to configure fail2ban for both TCP and UDP port?
I want to ban some DNS requests coming to my named server. The server normally listens both TCP and UDP port 53 and logs the requests to /var/log/named/query.log file. So, I added the following entry ...
0
votes
0
answers
697
views
SSH timing out - no longer able to access server after installing Fail2ban
I decided to improve security on my Ubuntu 20.04 server by installing fail2ban. Looks like I went too far :/
I was previously logging in fine using SSH.
I installed a default fail2ban install, copied ...
0
votes
1
answer
731
views
Fail2ban is not able to connect to mysql under reboot prosess, both shutdown and startup process, Can't connect to MySQL server on '127.0.0.1' (111)
I'm running a LAMP setup on Ubuntu 18.04.5 LTS (GNU/Linux 4.15.0-135-generic x86_64).
I have integrated fail2ban and db using documentation from https://docs.iredmail.org/fail2ban.sql.html#fail2ban-...
0
votes
0
answers
152
views
Can't block specific IP address with iptables, Ubuntu 16.04
I'm trying to troubleshoot Fail2ban recognizing our http-get-dos trigger, but not actually banning the offending host. I can see it adding entries to iptables rules, but they don't have any affect.
So ...
0
votes
0
answers
2k
views
Fail2ban not sending email
I set up Fail2ban as per this page: https://help.ubuntu.com/community/Fail2ban
I tried looking in several pages among others:
https://stackoverflow.com/questions/25890510/fail2ban-not-sending-email-...
0
votes
0
answers
626
views
fail2ban banned IP still able to connect
Having trouble with Fail2ban:
Background:
Using Ubuntu Server 18.04.2
Installed ufw
Installed and set up ssh with keys, random port other than 22, working
Installed fail2ban
Issue:
On same LAN ...
0
votes
1
answer
1k
views
Regex for fail2ban config file to match pregreet lines in mail.log
The lines in mail.log to match are like:
May 6 10:06:16 mikes-serverbox postfix/postscreen[15486]: PREGREET 14 after 0.1 from [173.225.99.104]:57130: EHLO ylmf-pc\r\n
May 9 11:36:36 mikes-...
0
votes
0
answers
273
views
fail2ban duplicate log entries
I am posing this as a question....
It seems every time I restart fail2ban it re-bans all the IP addresses and possibly creates a new log entry for every previous ban.
I pipe every ban to a text file ...
0
votes
1
answer
1k
views
UFW is not blocking IPs
so im working with fail2ban, ufw, and wordpress (NGINX).
I made plugin for creating 401 if someone fail to login
function wp_login_failed_403_res() {
status_header(403);
}
add_action( '...
0
votes
0
answers
3k
views
Protect Samba with fail2ban?
I know this isn't the smartest idea, but I use an ssh tunnel to forward samba to my raspberry pi NAS from my server. How can I protect samba against brute force attempts? I couldn't get fail2ban to ...
0
votes
0
answers
258
views
Unable to connect to SSH / Network issue
I know the information I'm providing is very limited but I lost SSH connection to my Ubuntu Mate (Odroid XU4).
I tried from different hosts, same issue, I also have very limited torrent connection ...
0
votes
0
answers
75
views
Constantly getting banned from servers when I try to SSH and/or login
We are using fail2banin our servers, and I'm getting banned randomly from them, even if I log in successfully, after typing some chars I get banned.
Also, when I do scp, it sometimes starts copying ...
-1
votes
1
answer
473
views
Help to make a fail2ban filter
I've already done some filters for my fail2ban, but just simple things, like:
[Definition]
failregex = ^ .* "GET .*/wp-login.php
ignoreregex =
i don't use wordpress on my server, so i block a ...