Questions tagged [fail2ban]
Fail2ban is a program designed to scan server log files and ban IP numbers suspected of malicious activity.
24
questions
5
votes
3
answers
2k
views
Does blocking an IP with IP Tables protect you from a DOS (not DDOS) attack?
I am fairly new to network security, and I just learned about the Fail2Ban framework you can use for automated exploit detection/prevention. It says that you can protect yourself from DOS attacks by ...
- 53
3
votes
1
answer
4k
views
How should output of fail2ban postfix-sasl look like
I want to be sure that fail2ban is properly banning failed postfix SASL login attempts.
When I do iptables -L I can see list of banned hosts for SSHD, but I can't figure out a way to see banned ...
- 272
2
votes
1
answer
1k
views
fail2ban - syntax for setting bantime in a unit other than seconds?
I have just installed fail2ban on my host.
All documentation I found, including fail2ban's latest official page, mentions seconds as the time unit to use to ban any given host.
So for example the ...
- 123
2
votes
2
answers
1k
views
Using fail2ban for detecting suspicious activity whitin a webserver
I know that fail2ban is mostly used for blocking IPs trying to brute force an SSH endpoint and other stuff like that.
However, I am wondering if you could also use fail2ban to detect (not necessarily ...
- 345
2
votes
1
answer
2k
views
Blocking slowloris using fail2ban, what are the correct parameters?
I have a fail2ban rule for Apache2 logs that which looks like this:
[Definition]
failregex = ^[^ ]+ <HOST> .* \[\] "[^\"]*" 408 \d+
This will detect the 408 errors which happen when a TCP ...
- 1,007
2
votes
1
answer
1k
views
Blocking brute forcer with multiple IPs in range
A few weeks ago, I allowed my Linux Server to be connected from the internet for development purposes. My networking knowledge is quite basic. Following some guidelines on securing Linux servers, I ...
user118989
1
vote
1
answer
603
views
Do I need fail2ban if I have a strong password?
Is there any advantage to me installing fail2ban on my VPS web server? As far as I understood, fail2ban's only purpose is to stop bruteforce and dictionary attacks by preventing consecutive password ...
- 167
1
vote
3
answers
808
views
Mailcleaner - Fail2ban - mc-exim-filter configuration
I'm using Fail2ban on a Mailcleaner server which works pretty good, but I want to update it to ban hosts who want to spoof our addresses. I'm using the "original" mc-exim-filter, but I don't ...
- 13
1
vote
1
answer
147
views
Access from external network safely to raspberry
I am implementing a home alarm system with raspberry and I need to access it from the external network. The initial idea was to use cascade VPN and ssh (in my university to connect to the cluster I ...
- 11
1
vote
1
answer
421
views
Block hex encoded requests using fail2ban
I have new web server running nginx. The default server is receiving 10K+ requests every day from Russian bots. They are clearly probing for something, but it's hard to say what since the requests ...
- 11
1
vote
2
answers
1k
views
Is something like fail2ban necessary for a rate-limited key-only (no password) ssh login?
As far as I understand, bruteforcing ssh is only attempted for passwords, not keys (barring edge cases where presumably the NSA wants to break in).
So if a server has disabled (in addition to root ...
- 423
1
vote
1
answer
2k
views
Does CSF-LFD include a Fail2Ban analogue or should include Fail2Ban at all?
I am not of the field of IS and After reading this CSF-LFD installation document, I've installed CSF-LFD via:
cd /usr/src
sudo rm -fv csf.tgz
sudo wget https://download.configserver.com/csf.tgz
sudo ...
user123574
1
vote
1
answer
226
views
Is it a security risk, lack of knowledge for reactive action, when abuse mail is rejected?
When inspecting the DNS configuration for example with dnsinspect.com, the following shows up sometimes (note I used example.com):
Accepts Abuse Address
WARNING: Found mail servers which are not ...
- 6,665
1
vote
1
answer
241
views
Bots are using my own static IP to brute force DNS/Email server [closed]
My email server has been under constant brute force attack for a while now, without success.
Recently, however, these bots or automated scripts have found a way to "use my own static IP" in ...
- 11
1
vote
0
answers
363
views
UFW behind modem does not block remote IP
I have a small linux server with fail2ban and UFW installed and configured behind internet gateway modem which ssh port is forwarded to server.
The attackers are discovering by fail2ban and added to ...
- 111
0
votes
1
answer
186
views
Block many wrong requests via PHP
I have an API that requires a security token to run.
Is it possible to use Fail2Ban or ModEvasive to block access from IPs that often try to access the API with an incorrect token?
I use PHP to ...
- 174
0
votes
1
answer
148
views
Limiting number of combo attempts with Fail2ban and 128 bits of entropy
Apps such as Fail2ban and DenyHosts enable unix administrators to limit username/password combo attempts to typically 3 attempts. But why 3? Some admins enable more, like 6 or 8 giving honest users a ...
- 111
0
votes
1
answer
1k
views
Increasing fail2ban ban time with each attempt
I haven't really found any way to do this - I have seen a few issues on the github dealing with it but nothing in the wiki indicating it exists.
Right now I have a problem, a set of 3 IP addresses ...
user178749
0
votes
2
answers
248
views
How to create custom rules for fail2ban in Apache?
In the last few weeks I've been having some problems with some users who are scanning our server for files, and in those searches they generate a lot of errors.
That's why I installed fail2ban, it ...
- 174
0
votes
1
answer
1k
views
Is fail2ban an intrusion prevention system?
I know what fail2ban does; it monitors the firewall logs and finds ip addresses that have too many failed logins to ssh; and then tells the firewall to drop packets from those addresses.
So is ...
- 1,431
0
votes
0
answers
91
views
Fail2ban not resulting in any update of IPTables
I have:
Installed Fail2ban
Created a local jail file.
Changed lines within /etc/fail2ban/jail.local where enabled is mentioned x2 to true.
Added enabled = true to the Asterisk section of the jail....
0
votes
0
answers
149
views
How does fail2ban et al deal with the IP neighbourhood of badly behaving IPs?
Please note, I'm looking more for established documented best-practice rather than personal opinion in this question. I'm also not interested in Fail2Ban specifically but the class of technologies ...
- 101
0
votes
0
answers
140
views
sshd login obfuscation by prompting for a password although password login is disabled?
The sshd.config and fail2ban both work by blocking authentication requests over a specified path, thus notifying the attacker about the protection measures in place.
Wouldn't it be more desirable to ...
- 113
-1
votes
1
answer
535
views
ssh login attempts still showing up even with password login disabled? [duplicate]
I switched all my servers to ssh publickey login and disabled password login about a week ago (root login IS still enabled). I also run Fail2ban and logwatch.
Why is there still login attempts ...
- 101