The remaining built-in filters protect infrastructure services: DNS servers, LDAP, remote desktop, VPN and router logins, generic PAM authentication, port-scan detectors, and a few chat and game servers. SSH and OpenVPN have their own guides (SSH, OpenVPN).

Filter	Service	Jail
`xrdp`	xrdp (RDP for Linux)	xrdp
`routeros-auth`	MikroTik RouterOS	routeros-auth
`counter-strike`	Counter-Strike 1.6 server	counter-strike
`ejabberd-auth`	ejabberd XMPP server	ejabberd-auth
`murmur`	Mumble server (murmur)	murmur
`named-refused`	BIND (named)	named-refused
`nsd`	NSD DNS server	nsd
`pam-generic`	Any PAM service	pam-generic
`portsentry`	PortSentry	portsentry
`scanlogd`	scanlogd	scanlogd
`screensharingd`	macOS Screen Sharing	screensharingd
`slapd`	OpenLDAP (slapd)	slapd
`softethervpn`	SoftEther VPN	softethervpn
`stunnel`	stunnel	stunnel
`xinetd-fail`	xinetd	xinetd-fail
`znc-adminlog`	ZNC IRC bouncer	znc-adminlog

Enable a jail by adding its block to /etc/fail2ban/jail.local, then run sudo fail2ban-client reload. If the service logs only to the systemd journal, add backend = systemd; if your distribution's default backend is systemd (Ubuntu 24.04, Debian 13) and the service writes a log file, add backend = auto. More in backends and the jail.local example.

`xrdp` xrdp (RDP for Linux)

The xrdp filter bans failed RDP logins on xrdp 0.9.19 or newer. File: /etc/fail2ban/filter.d/xrdp.conf; jail [xrdp]; log on Debian/Ubuntu: /var/log/xrdp-sesman.log.

/etc/fail2ban/jail.local

[xrdp]
enabled  = true
port     = 3389
logpath  = /var/log/xrdp-sesman.log

Log lines it bans (from fail2ban's test suite):

[20220407-12:11:06] [INFO ] AUTHFAIL: user=badtypist ip=::ffff:10.171.161.151 time=1649351466
[20220407-12:11:24] [INFO ] AUTHFAIL: user=192.168.0.1 ip=::ffff:10.171.161.151 time=1649351484
[20220407-12:22:02] [INFO ] AUTHFAIL: user=loginjector ip=192.168.0.4 time=123456789\n[20220407-12:16:59] [INFO ] AUTHFAIL: user=endinjection ip=::ffff:10.171.161.151 time=1649352122
Apr 7 12:11:06 servername xrdp-sesman[41441]: [INFO ] AUTHFAIL: user=badtypist ip=::ffff:10.171.161.151 time=1649351466
Apr 7 12:11:24 servername xrdp-sesman[41441]: [INFO ] AUTHFAIL: user=192.168.0.1 ip=::ffff:10.171.161.151 time=1649351484

Show the failregex fail2ban compiles (1 line)

failregex (1)

^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?xrdp-sesman(?:\(\S+\))?[\]\)]?:?|[\[\(]?xrdp-sesman(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?\[INFO \] AUTHFAIL: user=<F-USER>(?:\S+|.+)</F-USER> ip=<ADDR> time=\d+$

Test xrdp in the browser or on the server: sudo fail2ban-regex /var/log/xrdp-sesman.log xrdp · source

`routeros-auth` MikroTik RouterOS

The routeros-auth filter bans failed logins to a MikroTik router (via remote syslog). File: /etc/fail2ban/filter.d/routeros-auth.conf; jail [routeros-auth]; log on Debian/Ubuntu: /var/log/MikroTik/router.log.

/etc/fail2ban/jail.local

[routeros-auth]
enabled  = true
port     = ssh,http,https
logpath  = /var/log/MikroTik/router.log

Log lines it bans (from fail2ban's test suite):

Feb 15 11:25:46 gw.local system,error,critical login failure for user admin from 192.168.88.6 via web
Feb 15 11:57:42 1234.hostname.cz system,error,critical login failure for user from 2001:470:1:c84::24 via ssh
Mar 2 09:09:46 gw.local system,error,critical login failure for user user with space from 1.2.3.4 via ssh

Show the failregex fail2ban compiles (1 line)

failregex (1)

^\s*\S+ system,error,critical login failure for user <F-USER>.*?</F-USER> from <ADDR> via \S+$

Test routeros-auth in the browser or on the server: sudo fail2ban-regex /var/log/MikroTik/router.log routeros-auth · source

`counter-strike` Counter-Strike 1.6 server

The counter-strike filter bans players hammering the server with bad RCON passwords. File: /etc/fail2ban/filter.d/counter-strike.conf; jail [counter-strike]; log on Debian/Ubuntu: /opt/cstrike/logs/L[0-9]*.log.

/etc/fail2ban/jail.local

[counter-strike]
enabled  = true
logpath  = /opt/cstrike/logs/L[0-9]*.log

Log lines it bans (from fail2ban's test suite):

L 01/01/2014 - 01:25:17: Bad Rcon: "rcon 1146003691 "284" sv_contact "HLBrute 1.10"" from "31.29.29.89:57370"
L 01/01/2014 - 04:17:01: Bad Rcon: "rcon 260639614 "admin" sv_contact "HLBrute 1.10"" from "105.158.241.147:53772"

Show the failregex fail2ban compiles (1 line)

failregex (1)

^: Bad Rcon: "rcon \d+ "\S+"  sv_contact ".*?"" from "<HOST>:\d+"$

Test counter-strike in the browser or on the server: sudo fail2ban-regex /opt/cstrike/logs/L[0-9]*.log counter-strike · source

`ejabberd-auth` ejabberd XMPP server

The ejabberd-auth filter bans failed XMPP authentication on ejabberd. File: /etc/fail2ban/filter.d/ejabberd-auth.conf; jail [ejabberd-auth]; log on Debian/Ubuntu: /var/log/ejabberd/ejabberd.log.

/etc/fail2ban/jail.local

[ejabberd-auth]
enabled  = true
port     = 5222
logpath  = /var/log/ejabberd/ejabberd.log

Log lines it bans (from fail2ban's test suite):

I(<0.1440.0>:ejabberd_c2s:813) : ({socket_state,tls,{tlssock,#Port<0.6910>,#Port<0.6912>},<0.1439.0>}) Failed authentication for user@example.com from IP 192.0.2.4 ({{192,0,2,4},12716})
2014-01-07 18:09:08.512 [info] <0.22741.1>@ejabberd_c2s:wait_for_feature_request:662 ({socket_state,p1_tls,{tlssock,#Port<0.24718>,#Port<0.24720>},<0.22740.1>}) Failed authentication for test@example.com from IP 1.2.3.4
2015-03-19 13:57:35.805 [info] <0.585.0>@ejabberd_c2s:wait_for_sasl_response:965 ({socket_state,p1_tls,{tlssock,#Port<0.6434>,#Port<0.6436>},<0.584.0>}) Failed authentication for robin@example.com from 192.0.2.6
2017-07-29 08:24:04.773 [info] <0.6668.0>@ejabberd_c2s:handle_auth_failure:433 (http_bind|ejabberd_bosh) Failed c2s PLAIN authentication for test@example.ch from ::FFFF:192.0.2.3: Invalid username or password

Show the failregex fail2ban compiles (2 lines)

failregex (2)

^=INFO REPORT====  ===\nI\(<0\.\d+\.0>:ejabberd_c2s:\d+\) : \([^)]+\) Failed authentication for \S+ from (?:IP )?<HOST>(?: \({{(?:\d+,){3}\d+},\d+}\))?$
^(?:\.\d+)? \[info\] <0\.\d+\.\d>@ejabberd_c2s:\w+:\d+ \([^\)]+\) Failed (?:c2s \w+ )?authentication for \S+ from (?:IP )?(?:::FFFF:)?<HOST>(?:: |$)

Test ejabberd-auth in the browser or on the server: sudo fail2ban-regex /var/log/ejabberd/ejabberd.log ejabberd-auth · source

`murmur` Mumble server (murmur)

The murmur filter bans clients with wrong server passwords on a Mumble server. File: /etc/fail2ban/filter.d/murmur.conf; jail [murmur]; log on Debian/Ubuntu: /var/log/mumble-server/mumble-server.log.

/etc/fail2ban/jail.local

[murmur]
enabled  = true
port     = 64738
logpath  = /var/log/mumble-server/mumble-server.log

Log lines it bans (from fail2ban's test suite):

<W>2015-11-29 16:38:01.818 1 => <4:testUsernameOne(-1)> Rejected connection from 192.168.0.1:29530: Invalid server password
<W>2015-11-29 17:18:20.962 1 => <8:testUsernameTwo(-1)> Rejected connection from 192.168.1.2:29761: Wrong certificate or password for existing user
Test murmurd[2064]: <W>2019-09-08 13:00:05.615 1 => <10:Test(-1)> Rejected connection from 192.0.2.1:31752: Invalid server password

Show the failregex fail2ban compiles (2 lines)

prefregex

^(?:\S+\s+murmurd\[\d+\]:(?:\s+\<W\>[\d\-]+ [\d:]+.\d+)?)?\s+\d+ => <\d+:[^>]+\(-1\)> Rejected connection from <HOST>:\d+: <F-CONTENT>.+</F-CONTENT>$

failregex (2)

^Invalid server password$
^Wrong certificate or password for existing user$

Test murmur in the browser or on the server: sudo fail2ban-regex /var/log/mumble-server/mumble-server.log murmur · source

`named-refused` BIND (named)

The named-refused filter bans clients whose DNS queries or zone transfers BIND refused. File: /etc/fail2ban/filter.d/named-refused.conf; jail [named-refused]; log on Debian/Ubuntu: /var/log/named/security.log.

/etc/fail2ban/jail.local

[named-refused]
enabled  = true
port     = domain,953
logpath  = /var/log/named/security.log

Log lines it bans (from fail2ban's test suite):

Jul 24 14:16:55 raid5 named[3935]: client 194.145.196.18#4795: query 'ricreig.com/NS/IN' denied
Jul 24 14:16:56 raid5 named[3935]: client 62.123.164.113#32768: query 'ricreig.com/NS/IN' denied
Jul 24 14:17:13 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'geo-mueller.de/NS/IN' denied
Jul 24 14:20:25 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'shivaree.de/NS/IN' denied
Jul 24 14:23:36 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'mietberatung.de/NS/IN' denied

Show the failregex fail2ban compiles (3 lines)

prefregex

^\s*(?:\S+ (?:(?:\[\d+\])?:\s+\(?named(?:-\w+)?(?:\(\S+\))?\)?:?|\(?named(?:-\w+)?(?:\(\S+\))?\)?:?(?:\[\d+\])?:)\s+)?(?:(?!error|info)[\w-]+: )?(?:(?:error|info):\s*)?client(?: @\S*)? <HOST>#\S+(?: \([\S.]+\))?: <F-CONTENT>.+</F-CONTENT>\s(?:denied(?: \([^\)]*\))?|\(NOTAUTH\))\s*$

failregex (3)

^(?:view (?:internal|external): )?query(?: \(cache\))?
^zone transfer
^bad zone transfer request: '\S+/IN': non-authoritative zone

Test named-refused in the browser or on the server: sudo fail2ban-regex /var/log/named/security.log named-refused · source

`nsd` NSD DNS server

The nsd filter bans clients refused zone transfers or notifies by NSD. File: /etc/fail2ban/filter.d/nsd.conf; jail [nsd]; log on Debian/Ubuntu: /var/log/nsd.log.

/etc/fail2ban/jail.local

[nsd]
enabled  = true
port     = 53
logpath  = /var/log/nsd.log

Log lines it bans (from fail2ban's test suite):

[1387288694] nsd[7745]: info: ratelimit block example.com. type any target 192.0.2.0/24 query 192.0.2.105 TYPE255
[1387348935] nsd[23600]: info: axfr for zone domain.nl. from client 192.0.2.115 refused, no acl matches.
[2021-03-05 05:25:14.562] nsd[160800]: info: axfr for example.com. from 192.0.2.32 refused, no acl matches

Show the failregex fail2ban compiles (2 lines)

failregex (2)

^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?nsd(?:\(\S+\))?[\]\)]?:?|[\[\(]?nsd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?info: ratelimit block .* query <ADDR> TYPE255$
^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?nsd(?:\(\S+\))?[\]\)]?:?|[\[\(]?nsd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?info: .* from(?: client)? <ADDR> refused, no acl matches\.?$

Test nsd in the browser or on the server: sudo fail2ban-regex /var/log/nsd.log nsd · source

`pam-generic` Any PAM service

The pam-generic filter bans authentication failures reported by PAM for any service. File: /etc/fail2ban/filter.d/pam-generic.conf; jail [pam-generic]; log on Debian/Ubuntu: /var/log/auth.log.

/etc/fail2ban/jail.local

[pam-generic]
enabled  = true
logpath  = %(syslog_authpriv)s
backend  = %(syslog_backend)s
banaction = %(banaction_allports)s

Log lines it bans (from fail2ban's test suite):

Feb 7 15:10:42 example pure-ftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=pure-ftpd ruser=sample-user rhost=192.168.1.1
May 12 09:47:54 vaio sshd[16004]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=71-13-115-12.static.mdsn.wi.charter.com user=root
May 12 09:48:03 vaio sshd[16021]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=71-13-115-12.static.mdsn.wi.charter.com
May 15 18:02:12 localhost proftpd: (pam_unix) authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=66.232.129.62 user=mark
Jul 19 18:11:26 srv2 vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=an8767 rhost=www.google.com

Show the failregex fail2ban compiles (1 line)

prefregex

^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?\S+(?:\(\S+\))?[\]\)]?:?|[\[\(]?\S+(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?\(?pam_unix(?:\(\S+\))?\)?:?\s+authentication failure;(?:\s+(?:(?:logname|e?uid)=\S*)){0,3} tty=\S* <F-CONTENT>.+</F-CONTENT>$

failregex (1)

^ruser=<F-ALT_USER>(?:\S*|.*?)</F-ALT_USER> rhost=<HOST>(?:\s+user=<F-USER>(?:\S*|.*?)</F-USER>)?\s*$

Test pam-generic in the browser or on the server: sudo fail2ban-regex /var/log/auth.log pam-generic · source

`portsentry` PortSentry

The portsentry filter bans hosts that PortSentry detected port-scanning. File: /etc/fail2ban/filter.d/portsentry.conf; jail [portsentry]; log on Debian/Ubuntu: /var/lib/portsentry/portsentry.history.

/etc/fail2ban/jail.local

[portsentry]
enabled  = true
logpath  = /var/lib/portsentry/portsentry.history
maxretry = 1

Log lines it bans (from fail2ban's test suite):

1403884279 - 06/27/2014 17:51:19 Host: 192.168.56.1/192.168.56.1 Port: 1 TCP Blocked
1403884279 - 06/27/2014 17:51:19 Host: 192.168.56.1/192.168.56.1 Port: 1 UDP Blocked

Show the failregex fail2ban compiles (1 line)

failregex (1)

\/<HOST> Port\: [0-9]+ (TCP|UDP) Blocked$

Test portsentry in the browser or on the server: sudo fail2ban-regex /var/lib/portsentry/portsentry.history portsentry · source

`scanlogd` scanlogd

The scanlogd filter bans hosts that scanlogd caught port-scanning. File: /etc/fail2ban/filter.d/scanlogd.conf; jail [scanlogd]; log on Debian/Ubuntu: /var/log/messages.

/etc/fail2ban/jail.local

[scanlogd]
enabled  = true
logpath  = %(syslog_local0)s
banaction = %(banaction_allports)s

Log lines it bans (from fail2ban's test suite):

Mar 5 21:44:43 srv scanlogd: 192.0.2.123 to 192.0.2.1 ports 80, 81, 83, 88, 99, 443, 1080, 3128, ..., f????uxy, TOS 00, TTL 49 @20:44:43
Mar 5 21:44:44 srv scanlogd: 192.0.2.123 to 192.0.2.1 ports 497, 515, 544, 543, 464, 513, ..., fSrpauxy, TOS 00 @09:04:25
Mar 5 21:44:45 srv scanlogd: 192.0.2.123 to 192.0.2.1 ports 593, 548, 636, 646, 625, 631, ..., fSrpauxy, TOS 00, TTL 239 @17:34:00
Mar 5 21:44:46 srv scanlogd: 192.0.2.123 to 192.0.2.1 ports 22, 26, 37, 80, 25, 79, ..., fSrpauxy, TOS 00 @22:38:37

Show the failregex fail2ban compiles (1 line)

failregex (1)

^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?scanlogd(?:\(\S+\))?[\]\)]?:?|[\[\(]?scanlogd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?<ADDR>(?::<F-PORT/>)? to \S+ ports\b

Test scanlogd in the browser or on the server: sudo fail2ban-regex /var/log/messages scanlogd · source

`screensharingd` macOS Screen Sharing

The screensharingd filter bans failed VNC/Screen Sharing logins on macOS. File: /etc/fail2ban/filter.d/screensharingd.conf; jail [screensharingd]; log on Debian/Ubuntu: /var/log/system.log.

/etc/fail2ban/jail.local

[screensharingd]
enabled  = true
logpath  = /var/log/system.log

Log lines it bans (from fail2ban's test suite):

Oct 27 2015 12:35:40 test1.beezwax.net screensharingd[1170]: Authentication: FAILED :: User Name: sdfsdfs () mro :: Viewer Address: 192.168.5.247 :: Type: DH
Oct 27 2015 12:35:50 test1.beezwax.net screensharingd[1170]: Authentication: FAILED :: User Name: brown_s :: :: Viewer Address: 192.168.5.247 :: Type: DH
Oct 27 2015 12:26:01 test1.beezwax.net screensharingd[1170]: Authentication: FAILED :: User Name: brown @! s:: :: Viewer Address: 192.168.5.247 :: Type: DH

Show the failregex fail2ban compiles (1 line)

failregex (1)

^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?screensharingd(?:\(\S+\))?[\]\)]?:?|[\[\(]?screensharingd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?Authentication: FAILED :: User Name: .+ :: Viewer Address: <HOST> :: Type: DH$

Test screensharingd in the browser or on the server: sudo fail2ban-regex /var/log/system.log screensharingd · source

`slapd` OpenLDAP (slapd)

The slapd filter bans clients with repeated invalid LDAP credentials (error 49). File: /etc/fail2ban/filter.d/slapd.conf; jail [slapd]; log on Debian/Ubuntu: /var/log/slapd.log.

/etc/fail2ban/jail.local

[slapd]
enabled  = true
port     = ldap,ldaps
logpath  = /var/log/slapd.log

Log lines it bans (from fail2ban's test suite):

Jul 8 01:47:20 ldap-server slapd[1183]: conn=1022 op=1 RESULT tag=97 err=49 text=

Show the failregex fail2ban compiles (2 lines)

prefregex

^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?slapd(?:\(\S+\))?[\]\)]?:?|[\[\(]?slapd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?conn=<F-MLFID>\d+</F-MLFID>(?: (?:fd|op)=\d+){0,2} (?=ACCEPT|RESULT)<F-CONTENT>.+</F-CONTENT>$

failregex (2)

^<F-NOFAIL>ACCEPT</F-NOFAIL> from IP=<ADDR>:\d{1,5}\s+
^RESULT(?:\s(?!err)\S+=\S*)* err=49\b

Test slapd in the browser or on the server: sudo fail2ban-regex /var/log/slapd.log slapd · source

`softethervpn` SoftEther VPN

The softethervpn filter bans failed logins to a SoftEther VPN server. File: /etc/fail2ban/filter.d/softethervpn.conf; jail [softethervpn]; log on Debian/Ubuntu: /usr/local/vpnserver/security_log/*/sec.log.

/etc/fail2ban/jail.local

[softethervpn]
enabled  = true
port     = 500,4500
protocol = udp
logpath  = /usr/local/vpnserver/security_log/*/sec.log

Log lines it bans (from fail2ban's test suite):

2020-05-12 10:53:19.781 Connection "CID-72": User authentication failed. The user name that has been provided was "bob", from 80.10.11.12.
2020-05-13T10:53:19 localhost [myserver.com/VPN/defaultvpn] (2020-05-13 10:53:19.591) <SECURITY_LOG>: Connection "CID-594": User authentication failed. The user name that has been provided was "alice", from 80.10.11.13.

Show the failregex fail2ban compiles (1 line)

failregex (1)

^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?\S*(?:\(\S+\))?[\]\)]?:?|[\[\(]?\S*(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?(?:(?:\([\d\-]+ [\d:.]+\) )?<SECURITY_LOG>: )?Connection "[^"]+": User authentication failed. The user name that has been provided was "<F-USER>(?:[^"]+|.+)</F-USER>", from <ADDR>\.$

Test softethervpn in the browser or on the server: sudo fail2ban-regex /usr/local/vpnserver/security_log/*/sec.log softethervpn · source

`stunnel` stunnel

The stunnel filter bans clients failing TLS client-certificate checks in stunnel. File: /etc/fail2ban/filter.d/stunnel.conf; jail [stunnel]; log on Debian/Ubuntu: /var/log/stunnel4/stunnel.log.

/etc/fail2ban/jail.local

[stunnel]
enabled  = true
logpath  = /var/log/stunnel4/stunnel.log

Log lines it bans (from fail2ban's test suite):

2011.11.21 14:29:16 LOG3[28228:140093368055552]: SSL_accept from 10.7.41.61:33454 : 140890C7: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate

Show the failregex fail2ban compiles (1 line)

failregex (1)

^ LOG\d\[\d+:\d+\]:\ SSL_accept from <HOST>:\d+ : (?P<CODE>[\dA-F]+): error:(?P=CODE):SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate$

Test stunnel in the browser or on the server: sudo fail2ban-regex /var/log/stunnel4/stunnel.log stunnel · source

`xinetd-fail` xinetd

The xinetd-fail filter bans hosts refused by xinetd access control. File: /etc/fail2ban/filter.d/xinetd-fail.conf; jail [xinetd-fail]; log on Debian/Ubuntu: /var/log/daemon.log.

/etc/fail2ban/jail.local

[xinetd-fail]
enabled  = true
logpath  = %(syslog_daemon)s
backend  = %(syslog_backend)s
maxretry = 2
banaction = iptables-multiport-log

Log lines it bans (from fail2ban's test suite):

May 15 17:38:49 boo xinetd[16256]: FAIL: telnet address from=198.51.100.169
Aug 3 14:38:49 backup xinetd[31234]: FAIL: amanda libwrap from=198.51.100.223

Show the failregex fail2ban compiles (2 lines)

prefregex

^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?xinetd(?:\(\S+\))?[\]\)]?:?|[\[\(]?xinetd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?FAIL: <F-CONTENT>.+</F-CONTENT>$

failregex (2)

^\S+ address from=<HOST>$
^\S+ libwrap from=<HOST>$

Test xinetd-fail in the browser or on the server: sudo fail2ban-regex /var/log/daemon.log xinetd-fail · source

`znc-adminlog` ZNC IRC bouncer

The znc-adminlog filter bans failed ZNC logins (needs the adminlog module). File: /etc/fail2ban/filter.d/znc-adminlog.conf; jail [znc-adminlog]; log on Debian/Ubuntu: /var/lib/znc/moddata/adminlog/znc.log.

/etc/fail2ban/jail.local

[znc-adminlog]
enabled  = true
port     = 6667
logpath  = /var/lib/znc/moddata/adminlog/znc.log

Log lines it bans (from fail2ban's test suite):

[2018-10-27 01:40:55] [girst] failed to login from 1.2.3.4
[2019-09-08 15:53:19] [admin] failed to login from 192.0.2.1:65001

Show the failregex fail2ban compiles (1 line)

failregex (1)

^(?:\[\]\s+)?\[[^]]+\] failed to login from <ADDR>

Test znc-adminlog in the browser or on the server: sudo fail2ban-regex /var/lib/znc/moddata/adminlog/znc.log znc-adminlog · source

Spotted something wrong or out of date? Tell us — every page is checked against the current fail2ban release.

xrdp xrdp (RDP for Linux)

routeros-auth MikroTik RouterOS

counter-strike Counter-Strike 1.6 server

ejabberd-auth ejabberd XMPP server

murmur Mumble server (murmur)

named-refused BIND (named)

nsd NSD DNS server

pam-generic Any PAM service

portsentry PortSentry

scanlogd scanlogd

screensharingd macOS Screen Sharing

slapd OpenLDAP (slapd)

softethervpn SoftEther VPN

stunnel stunnel

xinetd-fail xinetd

znc-adminlog ZNC IRC bouncer

Related pages

`xrdp` xrdp (RDP for Linux)

`routeros-auth` MikroTik RouterOS

`counter-strike` Counter-Strike 1.6 server

`ejabberd-auth` ejabberd XMPP server

`murmur` Mumble server (murmur)

`named-refused` BIND (named)

`nsd` NSD DNS server

`pam-generic` Any PAM service

`portsentry` PortSentry

`scanlogd` scanlogd

`screensharingd` macOS Screen Sharing

`slapd` OpenLDAP (slapd)

`softethervpn` SoftEther VPN

`stunnel` stunnel

`xinetd-fail` xinetd

`znc-adminlog` ZNC IRC bouncer