Filter library

fail2ban filters for FTP servers

5 built-in filters, each with its jail block, exact regex, real log lines and a test link.

Updated 4 min readChecked against fail2ban 1.1.1

FTP servers are brute-forced as relentlessly as SSH, and fail2ban ships a filter for each common daemon. Pick your server below, copy the jail block into jail.local, and test it against your own log before relying on it. If you can, replace FTP with SFTP over SSH — then the SSH guide is all you need.

FilterServiceJail
vsftpdvsftpdvsftpd
gssftpdgssftpd (Kerberos FTP)gssftpd
proftpdProFTPDproftpd
pure-ftpdPure-FTPdpure-ftpd
wuftpdWU-FTPDwuftpd

Enable a jail by adding its block to /etc/fail2ban/jail.local, then run sudo fail2ban-client reload. If the service logs only to the systemd journal, add backend = systemd; if your distribution's default backend is systemd (Ubuntu 24.04, Debian 13) and the service writes a log file, add backend = auto. More in backends and the jail.local example.

vsftpd vsftpd

The vsftpd filter bans failed logins on vsftpd. File: /etc/fail2ban/filter.d/vsftpd.conf; jail [vsftpd]; log on Debian/Ubuntu: /var/log/vsftpd.log.

/etc/fail2ban/jail.local
[vsftpd]
enabled  = true
port     = ftp,ftp-data,ftps,ftps-data
logpath  = %(vsftpd_log)s

Log lines it bans (from fail2ban's test suite):

  1. Oct 11 01:06:47 ServerJV vsftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=209.67.1.67
  2. Feb 6 12:02:29 server vsftpd(pam_unix)[15522]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=64.168.103.1 user=user1
  3. Fri Jan 19 12:20:33 2007 [pid 27202] [anonymous] FAIL LOGIN: Client "64.106.46.98"
  4. Oct 23 21:15:42 vps vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=test rhost=58.254.172.161
  5. Thu Sep 8 00:39:49 2016 [pid 15019] [guest] FAIL LOGIN: Client "::ffff:192.0.2.1", "User is not in the allow user list."
Show the failregex fail2ban compiles (2 lines)
failregex (2)
^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?vsftpd(?:\(\S+\))?[\]\)]?:?|[\[\(]?vsftpd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?(?:\(?pam_unix(?:\(\S+\))?\)?:?\s+)?authentication failure; logname=<F-ALT_USER1>\S*</F-ALT_USER1> uid=\S* euid=\S* tty=(?:ftp)? ruser=<F-USER>\S*</F-USER> rhost=<HOST>(?:\s+user=<F-ALT_USER>\S*</F-ALT_USER>)?\s*$
^(?:\s*\[pid \d+\] |(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?vsftpd(?:\(\S+\))?[\]\)]?:?|[\[\(]?vsftpd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?)\[<F-USER>[^\]]+</F-USER>\] FAIL LOGIN: Client "<HOST>"(?:\s*$|,)

Test vsftpd in the browser or on the server: sudo fail2ban-regex /var/log/vsftpd.log vsftpd · source

gssftpd gssftpd (Kerberos FTP)

The gssftpd filter bans failed logins on the Kerberos FTP daemon. File: /etc/fail2ban/filter.d/gssftpd.conf; jail [gssftpd]; log on Debian/Ubuntu: /var/log/daemon.log.

/etc/fail2ban/jail.local
[gssftpd]
enabled  = true
port     = ftp,ftp-data,ftps,ftps-data
logpath  = %(syslog_daemon)s
backend  = %(syslog_backend)s

Log lines it bans (from fail2ban's test suite):

  1. Jan 22 18:09:46 host ftpd[132]: repeated login failures from 198.51.100.23 (example.com)
Show the failregex fail2ban compiles (1 line)
failregex (1)
^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?ftpd(?:\(\S+\))?[\]\)]?:?|[\[\(]?ftpd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?repeated login failures from <HOST> \(\S+\)$

Test gssftpd in the browser or on the server: sudo fail2ban-regex /var/log/daemon.log gssftpd · source

proftpd ProFTPD

The proftpd filter bans failed logins and unknown users on ProFTPD. File: /etc/fail2ban/filter.d/proftpd.conf; jail [proftpd]; log on Debian/Ubuntu: /var/log/proftpd/proftpd.log.

/etc/fail2ban/jail.local
[proftpd]
enabled  = true
port     = ftp,ftp-data,ftps,ftps-data
logpath  = %(proftpd_log)s
backend  = %(proftpd_backend)s

Log lines it bans (from fail2ban's test suite):

  1. Jan 10 00:00:00 myhost proftpd[12345] myhost.domain.com (123.123.123.123[123.123.123.123]): USER username (Login failed): User in /etc/ftpusers
  2. Feb 1 00:00:00 myhost proftpd[12345] myhost.domain.com (123.123.123.123[123.123.123.123]): USER username: no such user found from 123.123.123.123 [123.123.123.123] to 234.234.234.234:21
  3. Jun 09 07:30:58 platypus.ace-hosting.com.au proftpd[11864] platypus.ace-hosting.com.au (mail.bloodymonster.net[::ffff:67.227.224.66]): USER username (Login failed): Incorrect password.
  4. Jun 09 11:15:43 platypus.ace-hosting.com.au proftpd[17424] platypus.ace-hosting.com.au (::ffff:101.71.143.238[::ffff:101.71.143.238]): USER god: no such user found from ::ffff:101.71.143.238 [::ffff:101.71.143.238] to ::ffff:123.212.99.194:21
  5. Jun 13 22:07:23 platypus.ace-hosting.com.au proftpd[15719] platypus.ace-hosting.com.au (::ffff:59.167.242.100[::ffff:59.167.242.100]): SECURITY VIOLATION: root login attempted.
Show the failregex fail2ban compiles (3 lines)
prefregex
^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?proftpd(?:\(\S+\))?[\]\)]?:?|[\[\(]?proftpd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?\S+ \(\S+\[<HOST>\]\)[: -]+ <F-CONTENT>(?:USER|SECURITY|Maximum) .+</F-CONTENT>$
failregex (3)
^USER <F-USER>\S+|.*?</F-USER>(?: \(Login failed\))?: ([uU]ser not authorized for login|[nN]o such user found|[iI]ncorrect password|[pP]assword expired|[aA]ccount disabled|[iI]nvalid shell: '\S+'|[uU]ser in \S+|[lL]imit (access|configuration) denies login|[nN]ot a UserAlias|[mM]aximum login length exceeded)
^SECURITY VIOLATION: <F-USER>\S+|.*?</F-USER> login attempted
^Maximum login attempts \(\d+\) exceeded

Test proftpd in the browser or on the server: sudo fail2ban-regex /var/log/proftpd/proftpd.log proftpd · source

pure-ftpd Pure-FTPd

The pure-ftpd filter bans failed logins on Pure-FTPd. File: /etc/fail2ban/filter.d/pure-ftpd.conf; jail [pure-ftpd]; log on Debian/Ubuntu: /var/log/syslog.

/etc/fail2ban/jail.local
[pure-ftpd]
enabled  = true
port     = ftp,ftp-data,ftps,ftps-data
logpath  = %(pureftpd_log)s
backend  = %(pureftpd_backend)s

Log lines it bans (from fail2ban's test suite):

  1. Jan 31 16:54:07 desktop pure-ftpd: (?@24.79.92.194) [WARNING] Authentication failed for user [Administrator]
Show the failregex fail2ban compiles (1 line)
failregex (1)
^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?pure-ftpd(?:\(\S+\))?[\]\)]?:?|[\[\(]?pure-ftpd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?\(.+?@<HOST>\) \[WARNING\] (?:Godkendelse mislykkedes for \[.*\]|Authentifizierung fehlgeschlagen für Benutzer \[.*\].|Authentication failed for user \[.*\]|Autentificación fallida para el usuario \[.*\]|\[.*\] c'est un batard, il connait pas son code|Erreur d'authentification pour l'utilisateur \[.*\]|Azonosítás sikertelen \[.*\] felhasználónak|Autenticazione falita per l'utente \[.*\]|Autorisatie faalde voor gebruiker \[.*\]|Godkjennelse mislyktes for \[.*\]|\[.*\] kullanýcýsý için giriþ hatalý|Autenticação falhou para usuário \[.*\]|Autentificare esuata pentru utilizatorul \[.*\]|Autentifikace uživatele selhala \[.*\]|Autentyfikacja nie powiodła się dla użytkownika \[.*\]|Autentifikacia uzivatela zlyhala \[.*\]|Behörighetskontroll misslyckas för användare \[.*\]|Авторизация не удалась пользователю \[.*\]|\[.*\] 嶸盪 檣隸 褒ぬ|妏蚚氪\[.*\]桄痐囮啖|使用者\[.*\]驗證失敗)\s*$

Test pure-ftpd in the browser or on the server: sudo fail2ban-regex /var/log/syslog pure-ftpd · source

wuftpd WU-FTPD

The wuftpd filter bans failed logins on WU-FTPD. File: /etc/fail2ban/filter.d/wuftpd.conf; jail [wuftpd]; log on Debian/Ubuntu: /var/log/syslog.

/etc/fail2ban/jail.local
[wuftpd]
enabled  = true
port     = ftp,ftp-data,ftps,ftps-data
logpath  = %(wuftpd_log)s
backend  = %(wuftpd_backend)s

Log lines it bans (from fail2ban's test suite):

  1. Oct 6 09:59:26 myserver wu-ftpd[18760]: failed login from hj-145-173-a8.bta.net.cn [202.108.145.173]
  2. Oct 11 16:45:07 ubuntu wu-ftpd[2360]: failed login from example.com [198.51.100.71]
  3. Mar 22 09:35:02 SiD wu-ftpd[31278]: pam_unix(wu-ftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=198.51.100.71 user=root
Show the failregex fail2ban compiles (2 lines)
failregex (2)
^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?wu-ftpd(?:\(\S+\))?[\]\)]?:?|[\[\(]?wu-ftpd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?failed login from \S+ \[<HOST>\]\s*$
^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?wu-ftpd(?:\(\S+\))?[\]\)]?:?|[\[\(]?wu-ftpd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?\(?pam_unix(?:\(wu-ftpd:auth\))?\)?:?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=(ftp)? ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$

Test wuftpd in the browser or on the server: sudo fail2ban-regex /var/log/syslog wuftpd · source

Filter libraryAll 96 built-in fail2ban filters in one searchable list: sshd, nginx, Apache, Postfix, Dovecot, recidive and more, with regexes and sample log lines.Write a custom filterWrite a fail2ban custom filter step by step: filter.d anatomy, failregex tags like <HOST> and <F-USER>, datepattern, ignoreregex, JSON logs and testing.fail2ban regex testerFree online fail2ban regex tester. Paste log lines, pick any built-in filter or write a failregex with <HOST>, and see matches, missed lines and IPs to ban.fail2ban-regexHow to use fail2ban-regex to test a fail2ban filter or regex against a log file or the systemd journal, read the results and debug missed lines, with examples.jail.local exampleA complete fail2ban jail.local example for SSH, nginx and recidive, explained line by line, plus a minimal version, distro notes and how to add a custom jail.

Spotted something wrong or out of date? Tell us — every page is checked against the current fail2ban release.