fail2ban – Türker Yıldırım

The VPS that had been running since 2019

Deep diveFebruary 28, 202514 min read

A host provisioned in 2019, upgraded in place three times, and a provisioning script that has never been run against an empty machine.

fail2ban rules that had been matching nothing since 2022

NoteFebruary 20, 20252 min read

Three jails enabled, two of them watching log files that moved when the services were containerised. A jail watching a file that does not exist reports zero failures,…

fail2ban after moving ssh off 22, and why both

NoteJanuary 27, 20231 min read

Moving the port dropped the log noise by about 99%, which is the argument for doing it and not an argument for stopping there. A non-standard port is…

A recidive jail catches what short bans do not

NoteNovember 11, 20201 min read

A host banned for an hour returns at the end of the hour and starts again, so the same address is banned twenty times a week and the…

A recidive jail catches what the short bans do not

NoteSeptember 3, 20191 min read

A host banned for an hour returns at the end of the hour and starts again, so the same address is banned twenty times a week and the…

A recidive jail catches the ones that come back

NoteApril 24, 20182 min read

A host banned for an hour returns at the end of the hour and starts again, so the same address is banned twenty times a week and the…

fail2ban on a jail you actually read the logs for

NoteMarch 5, 20182 min read

Enabling every bundled jail produces bans from filters matching log formats your software does not emit, and a config nobody trusts enough to tune. fail2ban-regex against a real…

fail2ban on the application log, not just the server log

NoteApril 13, 20172 min read

SSH and HTTP basic auth are covered by shipped filters. A brute force against the application’s own login form is invisible to both, because it is a 200…

Ban an IP with fail2ban from the command line

SnippetNovember 10, 20151 min read

A fail2ban jail for nginx auth, not just SSH

NoteSeptember 15, 20152 min read

fail2ban is installed for SSH and left there, but the same brute force runs against every HTTP login on the box — a WordPress admin, a staging basic-auth…