Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

Fail2ban is a program designed to scan server log files and ban IP numbers suspected of malicious activity.

0
votes
0answers
34 views

Block hex encoded requests using fail2ban

I have new web server running nginx. The default server is receiving 10K+ requests every day from Russian bots. They are clearly probing for something, but it's hard to say what since the requests ...
1
vote
2answers
72 views

Is something like fail2ban necessary for a rate-limited key-only (no password) ssh login?

As far as I understand, bruteforcing ssh is only attempted for passwords, not keys (barring edge cases where presumably the NSA wants to break in). So if a server has disabled (in addition to root ...
0
votes
1answer
57 views

Increasing fail2ban ban time with each attempt

I haven't really found any way to do this - I have seen a few issues on the github dealing with it but nothing in the wiki indicating it exists. Right now I have a problem, a set of 3 IP addresses ...
5
votes
3answers
392 views

Does blocking an IP with IP Tables protect you from a DOS (not DDOS) attack?

I am fairly new to network security, and I just learned about the Fail2Ban framework you can use for automated exploit detection/prevention. It says that you can protect yourself from DOS attacks by ...
2
votes
1answer
769 views

How should output of fail2ban postfix-sasl look like

I want to be sure that fail2ban is properly banning failed postfix SASL login attempts. When I do iptables -L I can see list of banned hosts for SSHD, but I can't figure out a way to see banned ...
2
votes
1answer
372 views

Blocking slowloris using fail2ban, what are the correct parameters?

I have a fail2ban rule for Apache2 logs that which looks like this: [Definition] failregex = ^[^ ]+ <HOST> .* \[\] "[^\"]*" 408 \d+ This will detect the 408 errors which happen when a TCP ...
1
vote
0answers
143 views

UFW behind modem does not block remote IP

I have a small linux server with fail2ban and UFW installed and configured behind internet gateway modem which ssh port is forwarded to server. The attackers are discovering by fail2ban and added to ...
2
votes
1answer
686 views

Does CSF-LFD include a Fail2Ban analogue or should include Fail2Ban at all?

I am not of the field of IS and After reading this CSF-LFD installation document, I've installed CSF-LFD via: cd /usr/src sudo rm -fv csf.tgz sudo wget https://download.configserver.com/csf.tgz sudo ...
0
votes
0answers
50 views

sshd login obfuscation by prompting for a password although password login is disabled?

The sshd.config and fail2ban both work by blocking authentication requests over a specified path, thus notifying the attacker about the protection measures in place. Wouldn't it be more desirable to ...
2
votes
1answer
353 views

Blocking brute forcer with multiple IPs in range

A few weeks ago, I allowed my Linux Server to be connected from the internet for development purposes. My networking knowledge is quite basic. Following some guidelines on securing Linux servers, I ...
1
vote
1answer
135 views

Is it a security risk, lack of knowledge for reactive action, when abuse mail is rejected?

When inspecting the DNS configuration for example with dnsinspect.com, the following shows up sometimes (note I used example.com): Accepts Abuse Address WARNING: Found mail servers which are not ...