Collaborate Disseminate
I have:
Installed Fail2ban
Created a local jail file.
Changed lines within /etc/fail2ban/jail.local where enabled is mentioned x2 to true.
Added enabled = true to the Asterisk section of the jail.local file.
Increased ban time to 1 day.
… Continue reading Fail2ban not resulting in any update of IPTables
I’m trying to develop a custom filter to filter out some malicious attacks/scans on our filters, however I’m stuck at a point that the actionban does not take effect.
This is my jail.local:
[my-jail]
enabled = true
filter = my-filter
actio… Continue reading Fail2Ban custom rule fails to use actionban
In the last few weeks I’ve been having some problems with some users who are scanning our server for files, and in those searches they generate a lot of errors.
That’s why I installed fail2ban, it turns out that not all the errors I’ve bee… Continue reading How to create custom rules for fail2ban in Apache?
I have just installed fail2ban on my host.
All documentation I found, including fail2ban’s latest official page, mentions seconds as the time unit to use to ban any given host.
So for example the above page says
bantime | 600 sec | Dur… Continue reading fail2ban – syntax for setting bantime in a unit other than seconds?
I have seen some posts on stackexchange and other websites and have not been able to figure this out.
I am using fail2ban on Ubuntu 22 with exim, dovecot etc. for my mail server. There are some other applications on the same server as well… Continue reading Fail2ban – Exim configuration needed [migrated]
I have an API that requires a security token to run.
Is it possible to use Fail2Ban or ModEvasive to block access from IPs that often try to access the API with an incorrect token?
I use PHP to receive these requests, is it possible with i… Continue reading Block many wrong requests via PHP
I have an API that requires a security token to run.
Is it possible to use Fail2Ban or ModEvasive to block access from IPs that often try to access the API with an incorrect token?
I use PHP to receive these requests, is it possible with i… Continue reading Block many wrong requests via PHP
I switched all my servers to ssh publickey login and disabled password login about a week ago (root login IS still enabled). I also run Fail2ban and logwatch.
Why is there still login attempts showing up in the logs? I admit the number of… Continue reading ssh login attempts still showing up even with password login disabled?
I’m using Fail2ban on a Mailcleaner server which works pretty good, but I want to update it to ban hosts who want to spoof our addresses. I’m using the "original" mc-exim-filter, but I don’t really understand how regular expressi… Continue reading Mailcleaner – Fail2ban – mc-exim-filter configuration
I have installed the fail2ban package on my centos DB server. now I need to configure it if a "failed attempt" is over 3 times need to raise an email as given. any ideas in this regard.