Questions tagged [fail2ban]

Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc.

Filter by
Sorted by
Tagged with
0
votes
1answer
31 views

Fail2ban doesn't persist manual banned IPs after service restart

Just upgraded from f2b v0.9.6 to v0.10.5 on Ubuntu 14.04 using this thread, and it is banning normally according to my old jails that i copied from my previous version. But when i restart the service,...
1
vote
0answers
30 views

Fail2ban continuous log flood, what's happening?

A couple of days ago I noticed my server got very sluggish. When I investigated I noticed fail2ban was going crazy, the fail2ban-server process taking up 50% of CPU, and the fail2ban log file is ...
0
votes
0answers
40 views

Fail2ban & NAT PREROUTING not blocking requests

I am using a iptables rule to alter the destination of incoming packets on port 80 like: iptables -t nat -I PREROUTING -i eth0 -p TCP -d M.Y.I.P/32 --dport 80 -j DNAT --to-destination IN.TER.NAL.IP:...
1
vote
1answer
139 views

How to prevent x11vnc attacks: attempts to unauthorized logins?

My computer was freezing for 1 second every 5 seconds. I found it was someone repeatedly trying to log in through x11vnc. Is there some way I can have it reject connections from an IP address for a ...
17
votes
2answers
3k views

IP getting access even after blocking

78.128.113.62 - - [04/Jan/2020:19:59:33 +0530] "GET /efk-dashboard HTTP/1.1" 404 66914 "-" "python-requests/2.13.0" There are multiple access records like this even after I have run the commands ufw ...
0
votes
0answers
213 views

Fail2ban not sending email

I set up Fail2ban as per this page: https://help.ubuntu.com/community/Fail2ban I tried looking in several pages among others: https://stackoverflow.com/questions/25890510/fail2ban-not-sending-email-...
0
votes
0answers
92 views

fail2ban banned IP still able to connect

Having trouble with Fail2ban: Background: Using Ubuntu Server 18.04.2 Installed ufw Installed and set up ssh with keys, random port other than 22, working Installed fail2ban Issue: On same LAN ...
0
votes
0answers
65 views

Fail2ban and phpmyadmin

I installed PHPMyAdmin on a server where Fail2Ban was already installed. I added [phpmyadmin-syslog] part in jail.local, but something isn't clear to me. I checked the whole /var/log, but the only ...
5
votes
1answer
558 views

How should I write the fail2ban -> apache-badbots.conf rules?

I often have to add new rules to the apache-badbots.conf file, and every time I have the doubt that it no longer works... For example, this is my current apache-badbots.conf file: [Definition] ...
1
vote
0answers
231 views

ssh, fail2ban and max login attempts

I am testing fail2ban in a Ubuntu 18.04 LTS server in VirtualBox. I set maxretry = 3 in /etc/fail2ban/jail.local, and I tried to ssh connect from another virtual machine with a wrong password. After ...
1
vote
1answer
53 views

Fail2ban Dynamic IP

I need help setting up my Fail2ban. I have a client that your IP is Dynamic. and every time I need to wait for it to tell me the IP so I can include ignoreip. How can i make a script to collect if ...
0
votes
0answers
64 views

Fail2Ban action failed

I have fail2ban check that send notification to slack when it detect a new ban. This is my jail.local file: # cat jail.local [DEFAULT] findtime = 30 bantime = 60 maxretry = 3 [nginx] enabled = ...
1
vote
1answer
283 views

fail2ban actions to broaden the banned IP range

Is there a way to have fail2ban ban the entire class C network from which a ban address comes from? A
0
votes
1answer
401 views

Regex for fail2ban config file to match pregreet lines in mail.log

The lines in mail.log to match are like: May 6 10:06:16 mikes-serverbox postfix/postscreen[15486]: PREGREET 14 after 0.1 from [173.225.99.104]:57130: EHLO ylmf-pc\r\n May 9 11:36:36 mikes-...
0
votes
0answers
50 views

fail2ban is always taking CPU

I have on a ubuntu server fail2ban installed. On the server there are moments in which it is very quiet. Only fail2ban is always taking CPU. It is not much. on average, 7% of the cpu are used for ...
1
vote
0answers
82 views

Block IP:s recognized by logwatch using fail2ban+ufw?

I got fail2ban and logwatch running on my server. Each day I have a few IP:s that's been probing my server and also a few "Attempts to use known hacks", as it states in the daily mail. I would like ...
0
votes
0answers
76 views

fail2ban duplicate log entries

I am posing this as a question.... It seems every time I restart fail2ban it re-bans all the IP addresses and possibly creates a new log entry for every previous ban. I pipe every ban to a text file ...
6
votes
1answer
2k views

Block badbot with fail2ban via user agents in access.log

How can I create a filter to block these with fail2ban? 476 Mozilla/5.0 (compatible; BLEXBot/1.0; +http://webmeup-crawler.com/) 892 ltx71 - (http://ltx71.com/) 5367 Mozilla/5.0 (...
0
votes
0answers
327 views

What do the filters included in Fail2ban?

In my /filter.d/ directory of Fail2ban there are many filters. 3proxy.conf asterisk.conf ejabberd-auth.conf lighttpd-auth.conf oracleims.conf selinux-...
1
vote
1answer
44 views

Fail2ban ignoreip command crashing fail2ban

Recently I updated ubuntu 16.04 with the latest security updates and all of a sudden ignoreip stops fail2ban from running I comment this line out and it starts working Any ideas? i tried adding commas ...
0
votes
1answer
2k views

Job for fail2ban.service failed because the control process exited with error

I have a basic issue on getting fail2ban started on one of my machines. I have a machine with Ubuntu 16.04 freshly installed today, and I am following a variety of instructions on fail2ban from source ...
5
votes
1answer
4k views

unable to install fail2ban on ubuntu 18.04

I installed ubuntu server(18.04 version) a few days ago. and I tried to install fail2ban with apt tool but couldn't do that. Here's some information on my situation. root@ubuntu:~# cat /etc/os-...
1
vote
1answer
1k views

Fail2Ban not banning

Fail2Ban works fine with the built-in jails, but my custom OpenVPN jail doesn't ban anything, neither does my NGINX-DoS jail. The output of sudo fail2ban-client status openvpn is: Status for the jail:...
1
vote
2answers
5k views

Fail2ban Error on start

Recently, I have tried restarting Fail2ban and I have received an error, making it impossible to start... The full error I received from systemctl status fail2ban is as follows: Jan 03 18:27:02 ...
1
vote
0answers
622 views

can't set up fail2ban Ubuntu 16.04

I run: sudo apt-get update sudo apt-get install fail2ban sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local With out activating any jails or anything else: sudo systemctl restart fail2ban ...
0
votes
1answer
535 views

UFW is not blocking IPs

so im working with fail2ban, ufw, and wordpress (NGINX). I made plugin for creating 401 if someone fail to login function wp_login_failed_403_res() { status_header(403); } add_action( '...
1
vote
1answer
76 views

fail2ban makes nc fail

I have a problem with fail2ban here. (Configs see below) Before I had it I used nc -4 -d -n -z -w 1 <SERVER IP> 22 from my PC in a script to check if the server is reachable on SSH (should ...
1
vote
1answer
758 views

Fail2Ban blocks my IP address due to blocked traffic, how do I stop it from banning me?

I need to know what program or what specific rule is banning my ip as it happens often when I am programming. It will ban my routers internal IP since I am connecting through the LAN. Then after ...
1
vote
0answers
653 views

Fail2ban Not banning IP Address

I am using this jail in /etc/fail2ban/jail.local: [nginx-bots] enabled = true port = http,https filter = nginx-bots logpath = /var/log/nginx/access.log* maxretry = 1 bantime = 172800 ...
0
votes
0answers
1k views

Protect Samba with fail2ban?

I know this isn't the smartest idea, but I use an ssh tunnel to forward samba to my raspberry pi NAS from my server. How can I protect samba against brute force attempts? I couldn't get fail2ban to ...
2
votes
1answer
1k views

fail2ban banned my IP but I still can SSH

Hi I am trying to use fail2ban to protect my server's SSH. I can see my ip is banned from: sudo fail2ban-client status sshd But I can still ssh in the machine through the same ip. Why the fail2ban ...
0
votes
2answers
639 views

I'm attempting to enable postfix filtering in fail2ban and systemd won't let it start

systemctl status fail2ban.service * fail2ban.service - Fail2Ban Service Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; vendor preset: enabled) Active: ...
0
votes
0answers
212 views

Unable to connect to SSH / Network issue

I know the information I'm providing is very limited but I lost SSH connection to my Ubuntu Mate (Odroid XU4). I tried from different hosts, same issue, I also have very limited torrent connection ...
1
vote
1answer
1k views

how to update iptables-persistent?

After installing iptables-persistent I see: ubuntu@dur:~$ ubuntu@dur:~$ cat /etc/iptables/rules.v4 # Generated by iptables-save v1.6.0 on Wed Jan 11 14:36:17 2017 *filter :INPUT ACCEPT [251:16508] :...
0
votes
0answers
54 views

Constantly getting banned from servers when I try to SSH and/or login

We are using fail2banin our servers, and I'm getting banned randomly from them, even if I log in successfully, after typing some chars I get banned. Also, when I do scp, it sometimes starts copying ...
1
vote
3answers
3k views

Unable to install fail2ban on Ubuntu 16.04 LTS server!

I installed a new Ubuntu 16.04 LTS server. I want to protect it with fail2ban, but when I try to install the package I get an error. How do I resolve this problem? > apt-get install fail2ban ...
5
votes
2answers
9k views

Job for fail2ban.service failed because the control process exited with error code

I have installed fail2ban on my server (OS: Ubuntu 16.0.4 LTS). When I try to start it, I get the following error message: Job for fail2ban.service failed because the control process exited with ...
1
vote
0answers
606 views

Ubuntu Server 16.04 - Errors were encountered while processing fail2ban

When I try to install fail2ban on my Ubuntu Server 16.04 apt-get -install fail2ban I am getting error message: "Errors were encountered while processing fail2ban" I've tried unninstall fail2ban with ...
3
votes
2answers
7k views

Fail2ban 0.9.0 enabling jails

I updated my server to 16.04 and it only installs fail2ban 0.9.0. There is no option to enable jails and when I add it manually it fails to load. Any help much appreciated.
2
votes
2answers
496 views

How do I permanently removing a ban stored by Fail2Ban

I have two filters that have banned local addresses. I have added the addresses to ignoreip but the damage was done already and the bans are in place. Every time I reboot my computer I have to do an ...
3
votes
0answers
752 views

fail2ban: how to immediately ban those who attempt ssh userid logins

My OpenSSH server is set up to only allow key based logins. I get many attacks each day from bots trying to login using a userid and password. I have fail2ban configured and running already. How can I ...
0
votes
2answers
650 views

fail2ban won't work

A few days ago I setup a new whole Server (Mailserver with Zarafa / Postfix, Apache, MySQL, and so on). Everything works fine.. except fail2ban. Fail2ban do nothing. He don't even act if something is ...
1
vote
1answer
2k views

Fail2ban not banning for my custom filter

I have created a new filter in fail2ban for my owncloud installation. When I tested it with fail2ban-regex it returned matches, so I figured it was working. When I turn it on in the jail however it ...
5
votes
4answers
8k views

Fail2ban fails to start after update?

I have been using fail2ban for a while on my Ubuntu server. Recently (after upgrading to ubuntu 15.04 I assume) fail2ban has been failing to start. Initially, this was because the port option had ...
51
votes
5answers
225k views

vivid - failed to connect to upstart: connection refused

Just updated via do-release-upgrade and now certain upstart jobs such as fail2ban and plexmediaserver will not start (have tried reinstalling) $ sudo service fail2ban start Job for fail2ban.service ...
1
vote
1answer
2k views

How can I get fail2ban to stop banning my Filezilla SFTP?

When I started with an Ubuntu home server, fail2ban was a lifesaver - alerting me to multiple attempts at unauthorized SSH access to my server. Recently, after moving to a way off port, the only ...
4
votes
2answers
3k views

Fail2Ban Regex SSH Will not Match Auth.Log - Searched Everywhere for a Solution

Im trying to get Fail2Ban to work with the SSHD Config provided. When i run fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf The Output is as follows root@fw:/etc/fail2ban/filter....
7
votes
3answers
7k views

How do I tell if my brute force protection (fail2ban) is running?

I'm not sure if my fail2ban is running. How can I tell if it's currently running? Also, how do I tell if it is even running on startup?
38
votes
3answers
97k views

How do you view all of the banned IP's for Ubuntu 12.04 via the command line?

I can't seem to find a quick command to just view all the banned IP's on the server. Or is there a file I can just edit? I'm guessing fail2ban is the one that inputs all the IP's to ban. Where do I ...
5
votes
1answer
2k views

Why /var/log/auth.log is using diffrent timezone?

I've installed fail2ban on a Ubuntu box (14.04) but it didn't work correctly. As I tried to inspect the reason, I discovered that the timezone which is being used by the /var/log/auth.log file is ...