fail2ban filters: list of all built-in filters with regex

Q: Where are fail2ban filters located?

In /etc/fail2ban/filter.d/. Each .conf file is one filter, named after the file without the extension (sshd.conf is the sshd filter). Your own changes go in a .local file with the same name, or in a new .conf file for a completely custom filter.

Q: Can I use one filter for several jails?

Yes. Set filter = in each jail. You can pass different parameters per jail, for example filter = postfix[mode=auth] in one jail and filter = postfix[mode=rbl] in another, which is exactly how the stock postfix-sasl and postfix-rbl jails work.

A fail2ban filter is a file in /etc/fail2ban/filter.d/ with regular expressions (failregex) that recognize failed logins and other abuse in a log and extract the attacker's IP. fail2ban 1.1.1 ships 96 filters: sshd, nginx-http-auth, apache-auth, postfix, dovecot, recidive and many more. A jail uses the filter with the same name unless you set filter =. The full searchable list is below.

bash

ls /etc/fail2ban/filter.d/

Browse filters by service#

Filters for the services people protect most are documented inside their setup guides, next to the jail configuration. Everything else is grouped by type:

SSHsshd, dropbear and selinux-ssh Postfix and DovecotSMTP, SASL, RBL and IMAP/POP3 failures Mail servers and webmailExim, Sendmail, Courier, Cyrus, Roundcube, Horde, SOGo and more Web apps, proxies and panelsHAProxy, lighttpd, Squid, Grafana, Webmin, Guacamole and more FTP serversvsftpd, ProFTPD, Pure-FTPd, WU-FTPD Network and system servicesBIND, NSD, LDAP, xrdp, VPN, PAM, port-scan detectors Repeat offendersthe recidive filter

How filters, jails and actions fit together#

Part	Lives in	Answers
Filter	`filter.d/<name>.conf`	Which log lines are failures, and which IP caused them?
Jail	`jail.conf` / `jail.local`	Which log to read, how many failures, how long to ban?
Action	`action.d/<name>.conf`	How to ban: firewall, email, report?

A jail section like [nginx-http-auth] automatically uses filter.d/nginx-http-auth.conf, because the default is filter = %(__name__)s[mode=%(mode)s]. Several jails can share one filter with different options: postfix-sasl is filter = postfix[mode=auth]. Enabling a jail is covered in the jail.local example; actions are in the action library.

Most used filters#

How to choose a filter#

Find out where the service logs failures. A file (/var/log/nginx/error.log) or the journal (journalctl -u ssh). Note one real failure line.
Look for a matching filter in the list below. Search by service name. Many filters have modes; the filter page lists them.
Test it against your real log before enabling the jail, e.g. sudo fail2ban-regex /var/log/nginx/error.log nginx-http-auth or sudo fail2ban-regex systemd-journal sshd. The summary line shows how many lines matched. Zero matches on a log that contains failures means the filter doesn't fit your log format. See fail2ban-regex for the options.
No filter fits? Write your own in a few lines: custom filter guide. The regex tester lets you try regexes against pasted log lines in the browser.

Popular applications without a stock filter (Nextcloud, WordPress, Jellyfin, Home Assistant, Gitea…) are covered in the guides, with tested filters.

Customize a stock filter#

Don't edit files in filter.d/ that came with the package; upgrades overwrite them. Instead:

Change a mode or parameter from the jail: filter = sshd[mode=aggressive] or mode = aggressive in the jail.
Add regexes or ignores: create filter.d/<name>.local with failregex = %(known/failregex)s plus your lines. The .local is read after the .conf.
Something very different: copy the filter to a new name (filter.d/sshd-custom.conf) and point the jail at it.

Where the filters come from#

The stock filters live in the upstream repository under config/filter.d, each with test log samples in fail2ban/tests/files/logs/. Distribution packages install them unchanged to /etc/fail2ban/filter.d/. A newer fail2ban release often brings filter fixes (the 1.1.1 sshd filter, for example, matches the sshd-session process name used since OpenSSH 9.8), so check the version you run with fail2ban-client --version.

Files in filter.d/ that aren't filters on their own, like common.conf, apache-common.conf and botsearch-common.conf, hold shared regex fragments that other filters include.

All built-in filters#

Search by name or description. Each name opens the filter's page with its full definition, modes, the jails that use it and example log lines.

Filter	Service	What it catches
`3proxy`	3proxy proxy server	bans clients that fail proxy authentication on a 3proxy server
`apache-auth`	Apache HTTP Server	catches failed HTTP Basic/Digest authentication and denied access in the Apache error log
`apache-badbots`	Apache HTTP Server	bans known spam bots and e-mail harvesters by their User-Agent in the access log
`apache-botsearch`	Apache HTTP Server	bans scanners probing for admin pages and scripts that don't exist (phpMyAdmin, wp-login and similar)
`apache-fakegooglebot`	Apache HTTP Server	bans clients that claim to be Googlebot but fail a reverse-DNS check
`apache-modsecurity`	Apache + ModSecurity	bans clients whose requests were blocked by ModSecurity rules
`apache-nohome`	Apache HTTP Server	bans requests for user home directories (~user) that don't exist
`apache-noscript`	Apache HTTP Server	bans clients requesting scripts (php, asp, cgi, perl) that don't exist on the server
`apache-overflows`	Apache HTTP Server	bans clients sending overlong or malformed request URIs
`apache-pass`	Apache HTTP Server	port-knocking helper: records clients that request a secret URL so another jail can allow them
`apache-shellshock`	Apache HTTP Server	bans requests that try to exploit the Bash Shellshock bug through CGI headers
`assp`	ASSP anti-spam SMTP proxy	bans hosts that ASSP rejects for SMTP abuse
`asterisk`	Asterisk PBX	bans SIP and IAX clients with failed registrations, wrong passwords or unknown extensions
`bitwarden`	Bitwarden (self-hosted)	bans repeated failed logins to a self-hosted Bitwarden identity server
`centreon`	Centreon Web	bans failed logins to the Centreon monitoring web portal
`counter-strike`	Counter-Strike 1.6 server	bans players hammering the server with bad RCON passwords
`courier-auth`	Courier IMAP/POP3	bans failed IMAP and POP3 logins on Courier
`courier-smtp`	Courier MTA	bans relay attempts and failed SMTP authentication on Courier
`cyrus-imap`	Cyrus IMAP	bans failed IMAP/POP3 authentication on a Cyrus server
`dante`	Dante SOCKS server	bans clients that fail SOCKS authentication
`directadmin`	DirectAdmin control panel	bans failed logins to the DirectAdmin panel
`domino-smtp`	HCL/IBM Domino SMTP	bans failed SMTP authentication on a Domino server
`dovecot`	Dovecot IMAP/POP3	bans failed IMAP, POP3 and SASL logins logged by Dovecot
`dropbear`	Dropbear SSH	bans failed password logins and bad users on the Dropbear SSH server
`drupal-auth`	Drupal	bans failed Drupal logins (Drupal must log to syslog)
`ejabberd-auth`	ejabberd XMPP server	bans failed XMPP authentication on ejabberd
`exim-spam`	Exim MTA	bans hosts whose mail Exim rejected as spam (SpamAssassin, honeypot addresses)
`exim`	Exim MTA	bans hosts with failed SMTP auth, relay attempts and rejected recipients in Exim's main log
`freeswitch`	FreeSWITCH	bans SIP clients with failed registrations or calls on FreeSWITCH
`froxlor-auth`	Froxlor control panel	bans failed logins to the Froxlor server panel
`gitlab`	GitLab	bans failed sign-ins to a self-hosted GitLab (application or JSON log)
`grafana`	Grafana	bans failed logins to Grafana
`groupoffice`	Group-Office	bans failed logins to the Group-Office groupware
`gssftpd`	gssftpd (Kerberos FTP)	bans failed logins on the Kerberos FTP daemon
`guacamole`	Apache Guacamole	bans failed logins to the Guacamole remote-desktop gateway
`haproxy-http-auth`	HAProxy	bans clients that fail HTTP Basic authentication in front of HAProxy
`horde`	Horde webmail	bans failed logins to Horde webmail
`kerio`	Kerio Connect	bans hosts that Kerio Connect flags for SMTP spam, relay or auth failures
`lighttpd-auth`	lighttpd	bans failed HTTP authentication on lighttpd
`mongodb-auth`	MongoDB	bans failed MongoDB authentication attempts
`monit`	Monit	bans failed logins to Monit's built-in web interface
`monitorix`	Monitorix	bans failed authentication on Monitorix's built-in web server
`mssql-auth`	Microsoft SQL Server on Linux	bans failed SQL Server logins
`murmur`	Mumble server (murmur)	bans clients with wrong server passwords on a Mumble server
`mysqld-auth`	MySQL / MariaDB	bans hosts with repeated 'Access denied' errors in the MySQL/MariaDB error log
`nagios`	Nagios NRPE	bans hosts not allowed to talk to the NRPE agent
`named-refused`	BIND (named)	bans clients whose DNS queries or zone transfers BIND refused
`nginx-bad-request`	nginx	bans clients sending malformed requests that nginx answers with 400 Bad Request
`nginx-botsearch`	nginx	bans scanners requesting admin pages and scripts that don't exist (404s for wp-login, phpMyAdmin and similar)
`nginx-forbidden`	nginx	bans clients that keep hitting locations you deny in nginx (403 forbidden by rule)
`nginx-http-auth`	nginx	bans failed HTTP Basic authentication (auth_basic) in the nginx error log
`nginx-limit-req`	nginx	bans clients that keep tripping nginx limit_req rate limits
`nsd`	NSD DNS server	bans clients refused zone transfers or notifies by NSD
`openhab`	openHAB	bans failed authentication to openHAB's web and REST API
`openvpn`	OpenVPN	bans clients that fail the TLS handshake or authentication on an OpenVPN server
`openwebmail`	OpenWebMail	bans failed logins to OpenWebMail
`oracleims`	Oracle Communications Messaging Server	bans failed authentication in Oracle IMS XML logs
`pam-generic`	Any PAM service	bans authentication failures reported by PAM for any service
`perdition`	Perdition IMAP/POP3 proxy	bans failed logins through the Perdition mail proxy
`php-url-fopen`	PHP web apps	bans requests that pass a remote URL as a script parameter (remote file inclusion attempts)
`phpmyadmin-syslog`	phpMyAdmin	bans failed phpMyAdmin logins (phpMyAdmin logging to syslog)
`portsentry`	PortSentry	bans hosts that PortSentry detected port-scanning
`postfix`	Postfix MTA	bans hosts with rejected SMTP commands, failed SASL logins, RBL hits and unknown recipients in Postfix
`proftpd`	ProFTPD	bans failed logins and unknown users on ProFTPD
`proxmox`	Proxmox VE web UI	bans failed logins to the Proxmox VE web interface (pveproxy, port 8006)
`pure-ftpd`	Pure-FTPd	bans failed logins on Pure-FTPd
`qmail`	qmail	bans hosts rejected by qmail's RBL check
`recidive`	fail2ban itself	reads fail2ban's own log and bans IPs that keep getting banned, for much longer
`roundcube-auth`	Roundcube webmail	bans failed logins to Roundcube webmail
`routeros-auth`	MikroTik RouterOS	bans failed logins to a MikroTik router (via remote syslog)
`scanlogd`	scanlogd	bans hosts that scanlogd caught port-scanning
`screensharingd`	macOS Screen Sharing	bans failed VNC/Screen Sharing logins on macOS
`selinux-ssh`	OpenSSH via SELinux audit	bans failed SSH logins recorded in the SELinux audit log
`sendmail-auth`	Sendmail	bans failed SMTP AUTH attempts on Sendmail
`sendmail-reject`	Sendmail	bans hosts Sendmail rejected for relaying, unknown users or bad HELO
`sieve`	Dovecot ManageSieve	bans failed ManageSieve logins
`slapd`	OpenLDAP (slapd)	bans clients with repeated invalid LDAP credentials (error 49)
`softethervpn`	SoftEther VPN	bans failed logins to a SoftEther VPN server
`sogo-auth`	SOGo groupware	bans failed logins to SOGo
`solid-pop3d`	solid-pop3d	bans failed POP3 logins on solid-pop3d
`squid`	Squid proxy	bans clients trying to abuse a Squid proxy (denied requests, proxy bypass attempts)
`squirrelmail`	SquirrelMail	bans failed logins to SquirrelMail webmail
`sshd`	OpenSSH server	bans failed SSH logins: wrong passwords, invalid users, and in ddos/aggressive mode pre-auth disconnects and scans
`stunnel`	stunnel	bans clients failing TLS client-certificate checks in stunnel
`suhosin`	Suhosin PHP hardening	bans clients that trigger Suhosin PHP security alerts
`tine20`	Tine 2.0 groupware	bans failed logins to Tine 2.0
`traefik-auth`	Traefik reverse proxy	bans clients failing Basic/Digest auth in Traefik's access log (401 responses)
`uwimap-auth`	UW IMAP	bans failed logins on UW IMAP
`vaultwarden`	Vaultwarden	bans failed logins and wrong 2FA codes on Vaultwarden (self-hosted Bitwarden)
`vsftpd`	vsftpd	bans failed logins on vsftpd
`webmin-auth`	Webmin	bans failed Webmin logins
`wuftpd`	WU-FTPD	bans failed logins on WU-FTPD
`xinetd-fail`	xinetd	bans hosts refused by xinetd access control
`xrdp`	xrdp (RDP for Linux)	bans failed RDP logins on xrdp 0.9.19 or newer
`znc-adminlog`	ZNC IRC bouncer	bans failed ZNC logins (needs the adminlog module)
`zoneminder`	ZoneMinder	bans failed logins to the ZoneMinder CCTV web console

FAQ#

Where are fail2ban filters located?#

In /etc/fail2ban/filter.d/. Each .conf file is one filter, named after the file without the extension (sshd.conf is the sshd filter). Your own changes go in a .local file with the same name, or in a new .conf file for a completely custom filter.

How many filters does fail2ban have?#

fail2ban 1.1.1 ships 96 filters, covering SSH, web servers (nginx, Apache, lighttpd), mail servers (Postfix, Dovecot, Exim, Sendmail), FTP, databases, VoIP and many web applications. Run ls /etc/fail2ban/filter.d/ to see the ones installed on your system.

Can I use one filter for several jails?#

Yes. Set filter = <name> in each jail. You can pass different parameters per jail, for example filter = postfix[mode=auth] in one jail and filter = postfix[mode=rbl] in another, which is exactly how the stock postfix-sasl and postfix-rbl jails work.

Spotted something wrong or out of date? Tell us — every page is checked against the current fail2ban release.