Fail2Ban Reads log files that contain password failure reports and bans the corresponding IP addresses using firewall rules
Download

Fail2Ban Ranking & Summary

Fail2Ban Tags

parse block ban ip address block connection log file parser ban

Fail2Ban Description

Reads log files that contain password failure reports and bans the corresponding IP addresses using firewall rules Fail2Ban reads log files that contain password failure reports and bans the corresponding IP addresses using firewall rules.These rules can be defined by the user. Fail2Ban is able to easily read multiple log files such as the sshd or Apache web server ones. Here are some key features of "Fail2Ban": · Client/Server architecture. · Multi-threaded. · Highly configurable. · FAM/Gamin support. · Parses log files and looks for given patterns. · Executes commands when a pattern has been detected for the same IP address for more than X times. X can be changed. · After a given amount of time, executes another command in order to unban the IP address. · Uses Netfilter/Iptables by default but can also use TCP Wrapper (/etc/hosts.deny) and many other actions. · Handles log files rotation. · Can handle more than one service (sshd, apache, vsftpd, etc). · Resolves DNS hostname to IP address. Requirements: · Python 2.3 or later What's New in This Release: · Check the inode number for rotation in addition to checking the first line of the file. Thanks to Jonathan Kamens. Red Hat #503852. Tracker #2800279. · Moved the shutdown of the logging subsystem out of Server.quit() to the end of Server.start(). Fixes the 'cannot release un-acquired lock' error. · Added "Ban IP" command. Thanks to Arturo 'Buanzo' Busleiman. · Added two new filters: lighttpd-fastcgi and php-url-fopen. · Fixed the 'unexpected communication error' problem by means of use_poll=False in Python >= 2.6. · Merged patches from Debian package. Thanks to Yaroslav Halchenko. · Use current day and month instead of Jan 1st if both are not available in the log. Thanks to Andreas Itzchak Rehberg. · Try to match the regex even if the line does not contain a valid date/time. Described in Debian #491253. Thanks to Yaroslav Halchenko. · Added/improved filters and date formats. · Added actions to report abuse to ISP, DShield and myNetWatchman. Thanks to Russell Odom. · Suse init script. Remove socket file on startup is fail2ban crashed. Thanks to Detlef Reichelt. · Removed begin-line anchor for "standard" timestamp. Fixed Debian bug #500824. · Added nagios script. Thanks to Sebastian Mueller. · Added CPanel date format. Thanks to David Collins. Tracker #1967610. · Improved SASL filter. Thanks to Loic Pefferkorn. Tracker #2310410. · Added NetBSD ipfilter (ipf command) action. Thanks to Ed Ravin. Tracker #2484115. · Added cyrus-imap and sieve filters. Thanks to Jan Wagner. Debian bug #513953. · Changed template to be more restrictive. Debian bug #514163. · Use timetuple instead of utctimetuple for ISO 8601. Maybe not a 100% correct fix but seems to work. Tracker #2500276. · Made the named-refused regex a bit less restrictive in order to match logs with "view". Thanks to Stephen Gildea. · Fixed maxretry/findtime rate. Many thanks to Christos Psonis. Tracker #2019714.

Fail2Ban Related Software