You can subscribe to this list here.
2005 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
(11) |
Oct
(8) |
Nov
(10) |
Dec
(8) |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2006 |
Jan
(6) |
Feb
(1) |
Mar
(43) |
Apr
(17) |
May
(2) |
Jun
(8) |
Jul
(9) |
Aug
(14) |
Sep
(15) |
Oct
(25) |
Nov
(20) |
Dec
(12) |
2007 |
Jan
(29) |
Feb
(19) |
Mar
(8) |
Apr
(12) |
May
(10) |
Jun
(9) |
Jul
(40) |
Aug
(33) |
Sep
(74) |
Oct
(19) |
Nov
(31) |
Dec
(13) |
2008 |
Jan
(50) |
Feb
(52) |
Mar
(43) |
Apr
(21) |
May
(68) |
Jun
(28) |
Jul
(6) |
Aug
(25) |
Sep
(14) |
Oct
(32) |
Nov
(7) |
Dec
(13) |
2009 |
Jan
(25) |
Feb
(1) |
Mar
(2) |
Apr
(8) |
May
(4) |
Jun
(6) |
Jul
(24) |
Aug
(40) |
Sep
(24) |
Oct
(15) |
Nov
(31) |
Dec
(35) |
2010 |
Jan
(6) |
Feb
(1) |
Mar
(23) |
Apr
(16) |
May
(4) |
Jun
(36) |
Jul
(20) |
Aug
(13) |
Sep
(36) |
Oct
(12) |
Nov
(9) |
Dec
(2) |
2011 |
Jan
(16) |
Feb
(9) |
Mar
(21) |
Apr
(33) |
May
(27) |
Jun
(31) |
Jul
(20) |
Aug
(7) |
Sep
(20) |
Oct
(41) |
Nov
(29) |
Dec
(52) |
2012 |
Jan
(127) |
Feb
(36) |
Mar
(15) |
Apr
(40) |
May
(23) |
Jun
(43) |
Jul
(84) |
Aug
(50) |
Sep
(31) |
Oct
(45) |
Nov
(43) |
Dec
(47) |
2013 |
Jan
(39) |
Feb
(83) |
Mar
(50) |
Apr
(50) |
May
(79) |
Jun
(87) |
Jul
(71) |
Aug
(41) |
Sep
(39) |
Oct
(81) |
Nov
(61) |
Dec
(74) |
2014 |
Jan
(76) |
Feb
(50) |
Mar
(45) |
Apr
(62) |
May
(59) |
Jun
(21) |
Jul
(93) |
Aug
(64) |
Sep
(53) |
Oct
(44) |
Nov
(37) |
Dec
(43) |
2015 |
Jan
(60) |
Feb
(72) |
Mar
(35) |
Apr
(50) |
May
(52) |
Jun
(89) |
Jul
(110) |
Aug
(94) |
Sep
(77) |
Oct
(82) |
Nov
(41) |
Dec
(26) |
2016 |
Jan
(42) |
Feb
(44) |
Mar
(26) |
Apr
(55) |
May
(26) |
Jun
(17) |
Jul
(63) |
Aug
(38) |
Sep
(43) |
Oct
(50) |
Nov
(45) |
Dec
(55) |
2017 |
Jan
(26) |
Feb
(29) |
Mar
(28) |
Apr
(40) |
May
(2) |
Jun
(16) |
Jul
(22) |
Aug
(21) |
Sep
(35) |
Oct
(47) |
Nov
(10) |
Dec
(15) |
2018 |
Jan
(18) |
Feb
(35) |
Mar
(71) |
Apr
(9) |
May
(39) |
Jun
(19) |
Jul
(14) |
Aug
(108) |
Sep
(5) |
Oct
(34) |
Nov
(24) |
Dec
(13) |
2019 |
Jan
(13) |
Feb
(19) |
Mar
(33) |
Apr
(11) |
May
(21) |
Jun
(61) |
Jul
(21) |
Aug
(80) |
Sep
(26) |
Oct
(10) |
Nov
(8) |
Dec
(4) |
2020 |
Jan
(26) |
Feb
(81) |
Mar
(31) |
Apr
(37) |
May
(52) |
Jun
(10) |
Jul
(47) |
Aug
(25) |
Sep
(63) |
Oct
(36) |
Nov
(19) |
Dec
(18) |
2021 |
Jan
(49) |
Feb
(11) |
Mar
(18) |
Apr
(21) |
May
(66) |
Jun
(8) |
Jul
(35) |
Aug
(30) |
Sep
(10) |
Oct
(31) |
Nov
(4) |
Dec
(23) |
2022 |
Jan
(1) |
Feb
(16) |
Mar
(34) |
Apr
(6) |
May
(2) |
Jun
|
Jul
(1) |
Aug
(17) |
Sep
(1) |
Oct
(2) |
Nov
(4) |
Dec
(16) |
2023 |
Jan
(10) |
Feb
(39) |
Mar
(7) |
Apr
(44) |
May
(17) |
Jun
(20) |
Jul
|
Aug
(2) |
Sep
(10) |
Oct
(7) |
Nov
(3) |
Dec
(3) |
2024 |
Jan
(1) |
Feb
(10) |
Mar
(8) |
Apr
(1) |
May
(19) |
Jun
(15) |
Jul
(3) |
Aug
(5) |
Sep
|
Oct
|
Nov
|
Dec
|
From: Nils B. (L. Internet) <ni...@le...> - 2006-03-17 18:33:07
|
Harry Rarig wrote: > Interesting.... > > My website is a small one that I run for our Church. Not well > known or advertised, the community of interest tends to be small > and localized. Consequently, the pattern I see in my logfiles is > that of "robots" running through dictionary attacks on SSH and > FTP. Only a few attacks a day. > > In your case, maybe you have larger community of interest, a > popular server with many subscribers. Perhaps your website appears > on more of the lists used by the robots for attacks. In addition, > maybe some of your own subscribers are forgetting their correct > usernames and passwords. Our servers are shared hosting servers, hosting around 50 domains each. None of my clients have shell access via SSH, only my company has access to these servers. Nils. |
From: Rarig, H. <hr...@so...> - 2006-03-17 17:54:25
|
Interesting.... My website is a small one that I run for our Church. Not well known or = advertised, the community of interest tends to be small and localized. = Consequently, the pattern I see in my logfiles is that of "robots" = running through dictionary attacks on SSH and FTP. Only a few attacks a = day. =20 In your case, maybe you have larger community of interest, a popular = server with many subscribers. Perhaps your website appears on more of = the lists used by the robots for attacks. In addition, maybe some of = your own subscribers are forgetting their correct usernames and = passwords. Harry -----Original Message----- From: fai...@li... [mailto:fai...@li...]On Behalf Of Nils Breunese (Lemonbit Internet) Sent: Friday, March 17, 2006 9:08 AM To: fai...@li... Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily report Harry Rarig wrote: > Nils, > > Can you install and test the four logwatch files in the tarball I =20 > sent and see how good/bad it looks on one of your servers? I'll see if I can test this in the weekend. Actually I thought =20 everybody would have hundreds of entries in their fail2ban.log files, =20 but apparently not? Nils. ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting = language that extends applications into web and mobile media. Attend the live = webcast and join the prime developer group breaking into this new coding = territory! http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D110944&bid=3D241720&dat=3D= 121642 _______________________________________________ Fail2ban-users mailing list Fai...@li... https://lists.sourceforge.net/lists/listinfo/fail2ban-users |
From: Nils B. (L. Internet) <ni...@le...> - 2006-03-17 15:47:44
|
Cyril Jaquier wrote: >> I'll see if I can test this in the weekend. Actually I thought >> everybody >> would have hundreds of entries in their fail2ban.log files, but >> apparently not? > > I've got around 2-4 banned hosts per day. Sometimes more, sometimes > less. This is for ssh service only. I'm also using it only for ssh. Nils Breunese. |
From: Cyril J. <cyr...@bl...> - 2006-03-17 15:25:56
|
Hi, > I'll see if I can test this in the weekend. Actually I thought everybody > would have hundreds of entries in their fail2ban.log files, but > apparently not? I've got around 2-4 banned hosts per day. Sometimes more, sometimes less. This is for ssh service only. Regards, Cyril Jaquier |
From: Nils B. (L. Internet) <ni...@le...> - 2006-03-17 14:08:47
|
Harry Rarig wrote: > Nils, > > Can you install and test the four logwatch files in the tarball I > sent and see how good/bad it looks on one of your servers? I'll see if I can test this in the weekend. Actually I thought everybody would have hundreds of entries in their fail2ban.log files, but apparently not? Nils. |
From: Rarig, H. <hr...@so...> - 2006-03-17 12:33:19
|
Nils, Can you install and test the four logwatch files in the tarball I sent = and see how good/bad it looks on one of your servers? tnx, Harry -----Original Message----- From: fai...@li... [mailto:fai...@li...]On Behalf Of Nils Breunese (Lemonbit Internet) Sent: Thursday, March 16, 2006 8:08 PM To: fai...@li... Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily report Harry Rarig wrote: > Would be interested in hearing some anecdotal reports from the =20 > field about how many entries other subscribers to this mailing list =20 > are seeing in their fail2ban.log files...?? > > Are entries in your fail2ban.log file on the order of 1 or 2, =20 > dozens, hundreds, or more? I just checked two of my servers and both have hundreds of entries. =20 Both are hosting multiple domains and are directly facing the =20 internet. I guess my other servers have a similar number of entries =20 in their logs. Nils. ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting = language that extends applications into web and mobile media. Attend the live = webcast and join the prime developer group breaking into this new coding = territory! http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D110944&bid=3D241720&dat=3D= 121642 _______________________________________________ Fail2ban-users mailing list Fai...@li... https://lists.sourceforge.net/lists/listinfo/fail2ban-users |
From: Nils B. (L. Internet) <ni...@le...> - 2006-03-17 01:08:08
|
Harry Rarig wrote: > Would be interested in hearing some anecdotal reports from the > field about how many entries other subscribers to this mailing list > are seeing in their fail2ban.log files...?? > > Are entries in your fail2ban.log file on the order of 1 or 2, > dozens, hundreds, or more? I just checked two of my servers and both have hundreds of entries. Both are hosting multiple domains and are directly facing the internet. I guess my other servers have a similar number of entries in their logs. Nils. |
From: Rarig, H. <hr...@so...> - 2006-03-16 22:57:54
|
Yaroslav, Yeah, the thought crossed my mind that maybe I ought to do a little more = than just "cat" the fail2ban.log file...;-). I certainly would enjoy = doing this sometime in the future, but right now my stack is overflowing = big time with too many other commitments! On the other hand, my experience has been that very few robots are = attacking my site via FTP, and when they do the "magic" in vsftpd seems = to do a good job regulating the frequency of the attempts. However, = once they get past this, the 25 authentications per second dictionary = attacks that were plaguing me in the past have completely ceased now = that fail2ban is guarding the entrance to the castle! (Nice work guys!) As far as SSH goes, I am using the iptables "recent" option to manage = that (see http://olivier.sessink.nl/publications/blacklisting/index.html = [Note: replace "extern_in" with "INPUT" and "extern-out" with = "OUTPUT"]). Using this, the banned IPs show up automatically in the = logwatch default ssh and kernel reports. Would be interested in hearing some anecdotal reports from the field = about how many entries other subscribers to this mailing list are seeing = in their fail2ban.log files...?? =20 Are entries in your fail2ban.log file on the order of 1 or 2, dozens, = hundreds, or more? Cheers! Harry -----Original Message----- From: fai...@li... [mailto:fai...@li...]On Behalf Of Yaroslav Halchenko Sent: Thursday, March 16, 2006 4:54 PM To: fai...@li... Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily report Dear Harry, Thank you for logwatch scripts -- I was looking toward composing ones myself but never got to them ;-) Wouldn't you like to see a summary like VSFTPD: 12 IPs baned [list of IPs may be] SSH: 3 IPs baned [...] Another possibility would be to include for each IP on how many times it = was banned which would signal that bantime might be too low if you have multiple hits for the same IP If you have any spare moment, since you mastered logwatch already, would you mind writing a script to provide such statistics? Otherwise you just might get lengthy list of WARNINGs and I really think that statistics would be a better presentation of relevant information --=20 .-. =3D------------------------------ /v\ ----------------------------=3D Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting = language that extends applications into web and mobile media. Attend the live = webcast and join the prime developer group breaking into this new coding = territory! http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D110944&bid=3D241720&dat=3D= 121642 _______________________________________________ Fail2ban-users mailing list Fai...@li... https://lists.sourceforge.net/lists/listinfo/fail2ban-users |
From: Yaroslav H. <li...@on...> - 2006-03-16 21:54:30
|
Dear Harry, Thank you for logwatch scripts -- I was looking toward composing ones myself but never got to them ;-) Wouldn't you like to see a summary like VSFTPD: 12 IPs baned [list of IPs may be] SSH: 3 IPs baned [...] Another possibility would be to include for each IP on how many times it was banned which would signal that bantime might be too low if you have multiple hits for the same IP If you have any spare moment, since you mastered logwatch already, would you mind writing a script to provide such statistics? Otherwise you just might get lengthy list of WARNINGs and I really think that statistics would be a better presentation of relevant information -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |
From: Cyril J. <cyr...@bl...> - 2006-03-16 19:26:29
|
Hi, > Nice. Maybe this could be added to the next fail2ban rpm? Will be added to the next release of Fail2ban. Regards, Cyril Jaquier |
From: Nils B. (L. Internet) <ni...@le...> - 2006-03-16 14:14:57
|
Harry Rarig wrote: > For those of you that use logwatch to generate daily reports of > suspicious activity on your system, the following may be of > interest... > > In the attached tarball are four logwatch configuration and script > files that I created for adding fail2ban to the standard logwatch > summary report that is emailed to me by my server every morning. > Install these four files in the logwatch directories below (these > are the locations on Fedora) and you will get a daily summary of > the results posted to the fail2ban logfile /var/log/fail2ban.log. Nice. Maybe this could be added to the next fail2ban rpm? Nils. |
From: Rarig, H. <hr...@so...> - 2006-03-16 13:47:28
|
For those of you that use logwatch to generate daily reports of = suspicious activity on your system, the following may be of interest... In the attached tarball are four logwatch configuration and script files = that I created for adding fail2ban to the standard logwatch summary = report that is emailed to me by my server every morning. Install these = four files in the logwatch directories below (these are the locations on = Fedora) and you will get a daily summary of the results posted to the = fail2ban logfile /var/log/fail2ban.log. Below are the four files contained in the tarball: /etc/log.d/conf/logfiles/fail2ban.conf /etc/log.d/conf/services/fail2ban.conf /etc/log.d/scripts/services/fail2ban /etc/log.d/scripts/shared/applyeurodate After you install them, verify they are working correctly by attempting = to log into your ftp server from a remote location four or more times = using an invalid password. Then run the following command to confirm = the logwatch fail2ban service is working correctly: [root@birch ~]# logwatch --range Today --print --service fail2ban ################### LogWatch 5.2.2 (06/23/04) #################### Processing Initiated: Thu Mar 16 08:28:19 2006 Date Range Processed: today Detail Level of Output: 0 Logfiles for Host: birch.foobar.net ################################################################ --------------------- fail2ban-messages Begin ------------------------ 2006-03-16 08:00:30,273 WARNING: VSFTPD: Ban (600 s) 72.9.XXX.XXX 2006-03-16 08:10:30,310 WARNING: VSFTPD: Unban 72.9.XXX.XXX ---------------------- fail2ban-messages End ------------------------- ###################### LogWatch End ######################### [root@birch ~]# Cheers! Harry Rarig |
From: jesus g. g. <jes...@ya...> - 2006-03-09 11:53:26
|
Hello, But I have install iptables: [root@]# rpm -qi iptables Name : iptables Relocations: /usr Version : 1.2.8 Vendor: Fedora Legacy Release : 8.90.1.legacy Build Date: s\uffffb 05 feb 2005 00:09:33 CET Install Date: vie 04 nov 2005 00:48:28 CET Build Host: jane.spidermaker.fedoralegacy.org Group : Entorno de Sistema/Base Source RPM: iptables-1.2.8-8.90.1.legacy.src.rpm Size : 364077 License: GPL Signature : DSA/SHA1, s\uffffb 05 feb 2005 01:29:49 CET, Key ID 108c4512731002fa Packager : Marc Deslauriers <mar...@vi...> URL : http://www.netfilter.org/ Summary : Herramientas para la gesti\uffffn de las capacidades de filtrado de paquetes del kernel de Linux. Description : La utilidad iptables controla el c\uffffdigo de filtrando de paquetes de red en el kernel de Linux. Si quiere configurar un firewall o el enmascaramiento IP deber\uffffa instalar este paquete. [root@]# rpm -qi ipchains package ipchains is not installed I don't use Fan2ban in RedHat 9? Jesús "Nils Breunese (Lemonbit Internet)" <ni...@le...> escribió: jesus gascon gomez wrote: > Hello, > > I install Fail2ban in Redhat 9. > > 1) update python to 2.3: > python2.3-2.3-5pydotorg.i386.rpm > python2.3-devel-2.3-5pydotorg.i386.rpm > python2.3-tools-2.3-5pydotorg.i386.rpm > > 2) dowload the source code from 'fail2ban-0.6.0-CVS' and 'log4py-1.3': > (# python2.3 setup.py install) > > But when I tray to execute "fail2ban" or "python2.3 /usr/lib/ > fail2ban/fail2ban.py": > > > [root@jesus]# fail2ban > Traceback (most recent call last): > File "/usr/bin/fail2ban", line 43, in ? > import fail2ban > File "/usr/lib/fail2ban/fail2ban.py", line 42, in ? > > ImportError: No module named iptables Red Hat 9 uses ipchains instead of iptables for firewalling. Nils. ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory! http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642 _______________________________________________ Fail2ban-users mailing list Fai...@li... https://lists.sourceforge.net/lists/listinfo/fail2ban-users --------------------------------- LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com |
From: Nils B. (L. Internet) <ni...@le...> - 2006-03-09 11:21:27
|
jesus gascon gomez wrote: > Hello, > > I install Fail2ban in Redhat 9. > > 1) update python to 2.3: > python2.3-2.3-5pydotorg.i386.rpm > python2.3-devel-2.3-5pydotorg.i386.rpm > python2.3-tools-2.3-5pydotorg.i386.rpm > > 2) dowload the source code from 'fail2ban-0.6.0-CVS' and 'log4py-1.3': > (# python2.3 setup.py install) > > But when I tray to execute "fail2ban" or "python2.3 /usr/lib/ > fail2ban/fail2ban.py": > > > [root@jesus]# fail2ban > Traceback (most recent call last): > File "/usr/bin/fail2ban", line 43, in ? > import fail2ban > File "/usr/lib/fail2ban/fail2ban.py", line 42, in ? > > ImportError: No module named iptables Red Hat 9 uses ipchains instead of iptables for firewalling. Nils. |
From: jesus g. g. <jes...@ya...> - 2006-03-09 10:45:35
|
Hello, I install Fail2ban in Redhat 9. 1) update python to 2.3: python2.3-2.3-5pydotorg.i386.rpm python2.3-devel-2.3-5pydotorg.i386.rpm python2.3-tools-2.3-5pydotorg.i386.rpm 2) dowload the source code from 'fail2ban-0.6.0-CVS' and 'log4py-1.3': (# python2.3 setup.py install) But when I tray to execute "fail2ban" or "python2.3 /usr/lib/fail2ban/fail2ban.py": [root@jesus]# fail2ban Traceback (most recent call last): File "/usr/bin/fail2ban", line 43, in ? import fail2ban File "/usr/lib/fail2ban/fail2ban.py", line 42, in ? ImportError: No module named iptables --------------------------------- LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com |
From: Cyril J. <cyr...@bl...> - 2006-02-11 22:21:55
|
Hi, In order to get more people trying pre-release/CVS versions, I added nightly snapshots and an ebuild for CVS version. Nightly snapshots `-> http://fail2ban.sourceforge.net/nightly Ebuild for Fail2ban CVS `-> http://fail2ban.sourceforge.net/ebuilds/fail2ban-20060211.ebuild Feel free to test them ;) A+ Cyril Jaquier |
From: Cyril J. <cyr...@bl...> - 2006-01-22 11:21:41
|
Hi, The CHANGELOG for 0.6.1 is quite huge :/ However, it is mainly bug fixes and no critical features addition. I added initial support for /etc/hosts.deny and shorewall. The only changes are in the configuration file. Take a look at fail2ban.conf.shorewall and fail2ban.conf.hostsdeny in config/. I renamed fail2ban.conf.default to fail2ban.conf.iptables. Please test and report any bugs. I would release 0.6.1 as soon as possible (shorewall and hosts.deny are quite interesting features). ver. 0.6.? (200?/??/??) - ??? ---------- - Added permanent banning. Set banTime to a negative value to enable this feature (-1 is perfect). Thanks to Mannone - Fixed locale bug. Thanks to Fernando Jos=C3=A9 - Fixed crash when time format does not match data - Propagated patch from Debian to fix fail2ban search path addition to the path search list: now it is added first. Thanks to Nick Craig-Wood - Added SMTP authentification for mail notification. Thanks to Markus Hoffmann - Removed debug mode as it is confusing for people - Added parsing of timestamp in TAI64N format (#1275325). Thanks to Mark Edgington - Added patch #1382936 (Default formatted syslog logging). Thanks to Patrick B=F6rjesson - Removed 192.168.0.0/16 from ignoreip. Attacks could also come from the local network. - Robust startup: if iptables module does not get fully initialized after startup of fail2ban, fail2ban will do "maxreinit" attempts to initialize its own firewall. It will sleep between attempts for "polltime" number of seconds (closes Debian: #334272). Thanks to Yaroslav Halchenko - Added "interpolations" in fail2ban.conf. This is provided by the ConfigParser module. Old configuration files still work. Thanks to Yaroslav Halchenko - Added initial support for hosts.deny and shorewall. Need more testing. Please test. Thanks to kojiro from Gentoo forum for hosts.deny support A+ Cyril Jaquier |
From: Nils B. (L. Internet) <ni...@le...> - 2006-01-17 23:50:30
|
Cyril Jaquier wrote: > I've never tried DenyHosts so I can't really compare it to Fail2ban. > However, I can comment a bit on Fail2ban. > > [snip] > > I will start a new development branch on March (I'm too busy now). The > idea is to make Fail2ban a log parser that can execute actions on > given > events. It will provide much more "template" and will be "modular" (no > unique huge configuration file anymore). I also want to take advantage > of inotify or FAM instead of polling for file modification. Phil Schwartz (the author of DenyHosts) is also extending functionality through the use of 'plugins' (which are really just scripts that take an IP address, so you can add them to whatever you like (iptables rules for instance)). Some words from Phil (I asked the same question on the DenyHosts mailinglist): "I don't know much about fail2ban, other than that it's firewall based rather that tcp_wrappers based. However, you could create a plugin for DenyHosts that updates your firewall settings in addition to tcp_wrappers. My server is behind a hardware based firewall so using a software solution (such as ipchains) seems redundant." It sounds a bit like Fail2Ban and DenyHosts are doing basically the same thing starting from a different point but growing more and more alike (and you both say you never tried the other script :)). Maybe you should contact Phil sometime to ask what he's up to. Bye, Nils. |
From: Cyril J. <cyr...@bl...> - 2006-01-17 23:36:01
|
Hi Nils, I've never tried DenyHosts so I can't really compare it to Fail2ban. However, I can comment a bit on Fail2ban. * I'm preparing a new release (0.6.1) which will add support for /etc/hosts.deny and shorewall. This will only require changes in the configuration file. Fail2ban is quite flexible. You can do almost everything you want by tweaking the configuration file. You will have different configuration files: fail2ban.conf.iptables fail2ban.conf.hostsdeny fail2ban.conf.shorewall Copy the desired configuration file to /etc/fail2ban.conf, install iptables or shorewall if required and that's all. * I know that DenyHosts has a better documentation than Fail2ban. That's a really important point I think. I'm not a native english speaker and it takes me a lot of time to do (poorly written) documentation. * DenyHosts works on FreeBSD. Fail2ban should work on this system too without too much problems. However, I never get feedback from *BSD or other Unix platform. * Fail2Ban can monitor several files. You can check for failures in /var/log/apache2/error_log and /var/log/sshd/current. You could also decide to ban users which try to access to "_vti_bin" on your Apache server. Fail2ban is not designed for login failure only. I will start a new development branch on March (I'm too busy now). The idea is to make Fail2ban a log parser that can execute actions on given events. It will provide much more "template" and will be "modular" (no unique huge configuration file anymore). I also want to take advantage of inotify or FAM instead of polling for file modification. Regards, Cyril Jaquier Nils Breunese (Lemonbit Internet) wrote: > Hello, > > I've used DenyHosts [1] in the past and I'm currently using Fail2Ban. > The obvious differences I found is that Fail2Ban blocks hosts using > firewall rules, whereas DenyHosts uses /etc/hosts.deny. I know that > DenyHosts can be extended to (also) use firewall rules, but I like > Fail2Ban because it works like that out of the box. Can anybody point > out to me what the other differences between these two scripts are and > why you would choose one over the other? > > Thanks, > > Nils Breunese. > > [1] http://denyhosts.sourceforge.net/ > > > ------------------------------------------------------- > This SF.net email is sponsored by: Splunk Inc. Do you grep through log > files > for problems? Stop! Download the new AJAX search engine that makes > searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642 > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users > |
From: Nils B. (L. Internet) <ni...@le...> - 2006-01-17 17:44:49
|
Hello, I've used DenyHosts [1] in the past and I'm currently using Fail2Ban. The obvious differences I found is that Fail2Ban blocks hosts using firewall rules, whereas DenyHosts uses /etc/hosts.deny. I know that DenyHosts can be extended to (also) use firewall rules, but I like Fail2Ban because it works like that out of the box. Can anybody point out to me what the other differences between these two scripts are and why you would choose one over the other? Thanks, Nils Breunese. [1] http://denyhosts.sourceforge.net/ |
From: Cyril J. <cyr...@bl...> - 2006-01-09 09:59:48
|
Hi, Fail2ban must find the IP address in the same line as "authentication failed". Sorry :( Maybe you can adjust log output in the SSH server settings!? "last message repeated 2 times" is syslog daemon dependant. For syslog-ng, look at: http://groups.google.com/group/comp.unix.bsd.freebsd.misc/browse_thread/thread/88f35008d8afeab8/f169ff9475dbd3b6 Regards, Cyril Menno Alkemade wrote: > Hi, > > i'm trying to get fail2ban running on our servers, it seems to run but not > detecting the failed logins. We are using the non-commercial version of the > ssh.com sshd (not my choice) and getting the following results of a failed > login in our logs: > > Jan 5 09:44:52 XXXXX sshd[280]: [ID 702911 auth.info] connection from > "xx.xx.xx.xx" > Jan 5 09:44:54 XXXXX sshd[25932]: [ID 702911 auth.warning] password > authentication failed. Login to account root not allowed or account non-existent. > Jan 5 09:45:02 XXXXX last message repeated 2 times > > Is it still possible for fail2ban to ban an IP while there is no IP in the > "authentication failed" line ? And is there a way around the "last message > repeated 2 times" ? > > regards, > > Menno Alkemade > > -- > Sapienza Consulting LTD > > > > ------------------------------------------------------- > This SF.net email is sponsored by: Splunk Inc. Do you grep through log files > for problems? Stop! Download the new AJAX search engine that makes > searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! > http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users > |
From: Menno A. <mal...@sa...> - 2006-01-09 09:21:28
|
Hi, i'm trying to get fail2ban running on our servers, it seems to run but not detecting the failed logins. We are using the non-commercial version of the ssh.com sshd (not my choice) and getting the following results of a failed login in our logs: Jan 5 09:44:52 XXXXX sshd[280]: [ID 702911 auth.info] connection from "xx.xx.xx.xx" Jan 5 09:44:54 XXXXX sshd[25932]: [ID 702911 auth.warning] password authentication failed. Login to account root not allowed or account non-existent. Jan 5 09:45:02 XXXXX last message repeated 2 times Is it still possible for fail2ban to ban an IP while there is no IP in the "authentication failed" line ? And is there a way around the "last message repeated 2 times" ? regards, Menno Alkemade -- Sapienza Consulting LTD |
From: Cyril J. <cyr...@bl...> - 2005-12-23 18:51:11
|
Hi, > 2005-12-23 17:39:06,845 WARNING: DEBUG MODE: FIREWALL COMMANDS ARE _NOT_ > EXECUTED BUT ONLY DISPLAYED IN THE LOG MESSAGES I will remove this %#@& debug mode in the next release ;) In debug mode, firewall commands are _NOT_ executed. I use this option to test Fail2ban but it seems to be quite confusing for people. Just remove "-d" and/or set "debug = false". This will fix your problem ;) Regards, Cyril Jaquier |
From: Mauce <met...@gm...> - 2005-12-23 16:49:21
|
Hi Yaroslav, This is the requested logging 2005-12-23 17:39:06,844 WARNING: Verbose level is 2 2005-12-23 17:39:06,845 WARNING: DEBUG MODE: FIREWALL COMMANDS ARE _NOT_ EXECUTED BUT ONLY DISPLAYED IN THE LOG MESSAGES 2005-12-23 17:39:06,845 DEBUG: Created PID lock (1511) in /var/run/fail2ban.pid 2005-12-23 17:39:06,846 DEBUG: ConfFile is /etc/fail2ban.conf 2005-12-23 17:39:06,846 DEBUG: BanTime is 600 2005-12-23 17:39:06,846 DEBUG: FindTime is 600 2005-12-23 17:39:06,846 DEBUG: MaxFailure is 5 2005-12-23 17:39:06,847 INFO: Fail2Ban v0.6.0 is running 2005-12-23 17:39:06,849 DEBUG: Add 127.0.0.1 to ignore list 2005-12-23 17:39:06,849 DEBUG: Add 192.168.0.0/16 to ignore list 2005-12-23 17:39:06,849 DEBUG: Nothing to do 2005-12-23 17:39:06,850 DEBUG: SSH: Initialize firewall rules 2005-12-23 17:39:06,850 DEBUG: iptables -N fail2ban-ssh iptables -A fail2ban-ssh -j RETURN iptables -I INPUT -p tcp --dport ssh -j fail2ban-ssh 2005-12-23 17:39:06,850 DEBUG: /var/log/auth.log has been modified 2005-12-23 17:39:06,850 DEBUG: /var/log/auth.log 2005-12-23 17:39:06,863 DEBUG: Date 0 is smaller than 1134875254.0 2005-12-23 17:39:06,863 DEBUG: Log rotation detected for /var/log/auth.log 2005-12-23 17:39:06,863 DEBUG: Setting file position to 0 for /var/log/auth.log The logging says it creates a new chain in iptables but when I check it's not there: /fail2ban-0.6.0 # iptables --list Chain INPUT (policy ACCEPT) target prot opt source destination SSHD tcp -- anywhere anywhere tcp dpt:ssh Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain SSHD (1 references) target prot opt source destination But when I execute the fwstart commands manually it does work (so it's not = a syntax issue): # iptables -N fail2ban-ssh # iptables -A fail2ban-ssh -j RETURN # iptables -I INPUT -p tcp --dport ssh -j fail2ban-ssh # iptables --list Chain INPUT (policy ACCEPT) target prot opt source destination fail2ban-ssh tcp -- anywhere anywhere tcp dpt:ssh fail2ban-ftp tcp -- anywhere anywhere tcp dpt:ftp SSHD tcp -- anywhere anywhere tcp dpt:ssh Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain SSHD (1 references) target prot opt source destination Chain fail2ban-ftp (1 references) target prot opt source destination Chain fail2ban-ssh (1 references) target prot opt source destination RETURN all -- anywhere anywhere Once the chains are created successfully (by hand) the same problem occurs when an IP needs to be banned. In that case the log files also says it banned the IP but when check it out with 'iptables --list' nothing is configured (and access from that IP is still possible) Any ideas how to proceed from here? Thanks in advance! Mauce 2005/12/23, Yaroslav Halchenko <li...@on...>: > > Please boost up verbose to 2 and then analyse/send the log file > > -- > .-. > =3D------------------------------ /v\ ----------------------------=3D > Keep in touch // \\ (yoh@|www.)onerussian.com > Yaroslav Halchenko /( )\ ICQ#: 60653192 > Linux User ^^-^^ [175555] > > > > > ------------------------------------------------------- > This SF.net email is sponsored by: Splunk Inc. Do you grep through log > files > for problems? Stop! Download the new AJAX search engine that makes > searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! > http://ads.osdn.com/?ad_id=3D7637&alloc_id=3D16865&op=3Dclick > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users > -- __________ MetalMauce met...@gm... |
From: Yaroslav H. <li...@on...> - 2005-12-23 16:21:02
|
Please boost up verbose to 2 and then analyse/send the log file -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |