Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [fail2ban]

Fail2ban is a program designed to scan server log files and ban IP numbers suspected of malicious activity.

1
vote
1answer
66 views

Access from external network safely to raspberry

I am implementing a home alarm system with raspberry and I need to access it from the external network. The initial idea was to use cascade VPN and ssh (in my university to connect to the cluster I ...
0
votes
0answers
41 views

Block hex encoded requests using fail2ban

I have new web server running nginx. The default server is receiving 10K+ requests every day from Russian bots. They are clearly probing for something, but it's hard to say what since the requests ...
1
vote
2answers
84 views

Is something like fail2ban necessary for a rate-limited key-only (no password) ssh login?

As far as I understand, bruteforcing ssh is only attempted for passwords, not keys (barring edge cases where presumably the NSA wants to break in). So if a server has disabled (in addition to root ...
0
votes
1answer
64 views

Increasing fail2ban ban time with each attempt

I haven't really found any way to do this - I have seen a few issues on the github dealing with it but nothing in the wiki indicating it exists. Right now I have a problem, a set of 3 IP addresses ...
5
votes
3answers
486 views

Does blocking an IP with IP Tables protect you from a DOS (not DDOS) attack?

I am fairly new to network security, and I just learned about the Fail2Ban framework you can use for automated exploit detection/prevention. It says that you can protect yourself from DOS attacks by ...
2
votes
1answer
1k views

How should output of fail2ban postfix-sasl look like

I want to be sure that fail2ban is properly banning failed postfix SASL login attempts. When I do iptables -L I can see list of banned hosts for SSHD, but I can't figure out a way to see banned ...
2
votes
1answer
413 views

Blocking slowloris using fail2ban, what are the correct parameters?

I have a fail2ban rule for Apache2 logs that which looks like this: [Definition] failregex = ^[^ ]+ <HOST> .* \[\] "[^\"]*" 408 \d+ This will detect the 408 errors which happen when a TCP ...
1
vote
0answers
148 views

UFW behind modem does not block remote IP

I have a small linux server with fail2ban and UFW installed and configured behind internet gateway modem which ssh port is forwarded to server. The attackers are discovering by fail2ban and added to ...
2
votes
1answer
755 views

Does CSF-LFD include a Fail2Ban analogue or should include Fail2Ban at all?

I am not of the field of IS and After reading this CSF-LFD installation document, I've installed CSF-LFD via: cd /usr/src sudo rm -fv csf.tgz sudo wget https://download.configserver.com/csf.tgz sudo ...
0
votes
0answers
56 views

sshd login obfuscation by prompting for a password although password login is disabled?

The sshd.config and fail2ban both work by blocking authentication requests over a specified path, thus notifying the attacker about the protection measures in place. Wouldn't it be more desirable to ...
2
votes
1answer
387 views

Blocking brute forcer with multiple IPs in range

A few weeks ago, I allowed my Linux Server to be connected from the internet for development purposes. My networking knowledge is quite basic. Following some guidelines on securing Linux servers, I ...
1
vote
1answer
136 views

Is it a security risk, lack of knowledge for reactive action, when abuse mail is rejected?

When inspecting the DNS configuration for example with dnsinspect.com, the following shows up sometimes (note I used example.com): Accepts Abuse Address WARNING: Found mail servers which are not ...