nginx and Apache have their own guides (nginx, Apache). This page collects the other web-facing filters that ship with fail2ban 1.1.1: alternative web servers and proxies, monitoring dashboards, hosting panels and self-hosted apps. Apps without a stock filter — WordPress, Nextcloud, Jellyfin, Home Assistant — have dedicated guides.

Filter	Service	Jail
`guacamole`	Apache Guacamole	guacamole
`haproxy-http-auth`	HAProxy	haproxy-http-auth
`monit`	Monit	monit
`grafana`	Grafana	grafana
`3proxy`	3proxy proxy server	3proxy
`webmin-auth`	Webmin	webmin-auth
`php-url-fopen`	PHP web apps	php-url-fopen
`centreon`	Centreon Web	centreon
`dante`	Dante SOCKS server	dante
`directadmin`	DirectAdmin control panel	directadmin
`drupal-auth`	Drupal	drupal-auth
`froxlor-auth`	Froxlor control panel	froxlor-auth
`groupoffice`	Group-Office	groupoffice
`lighttpd-auth`	lighttpd	lighttpd-auth
`monitorix`	Monitorix	monitorix
`nagios`	Nagios NRPE	nagios
`openhab`	openHAB	openhab-auth
`squid`	Squid proxy	squid
`suhosin`	Suhosin PHP hardening	suhosin
`tine20`	Tine 2.0 groupware	tine20
`zoneminder`	ZoneMinder	zoneminder

Enable a jail by adding its block to /etc/fail2ban/jail.local, then run sudo fail2ban-client reload. If the service logs only to the systemd journal, add backend = systemd; if your distribution's default backend is systemd (Ubuntu 24.04, Debian 13) and the service writes a log file, add backend = auto. More in backends and the jail.local example.

`guacamole` Apache Guacamole

The guacamole filter bans failed logins to the Guacamole remote-desktop gateway. File: /etc/fail2ban/filter.d/guacamole.conf; jail [guacamole]; log on Debian/Ubuntu: /var/log/tomcat*/catalina.out.

/etc/fail2ban/jail.local

[guacamole]
enabled  = true
port     = http,https
logpath  = /var/log/tomcat*/catalina.out

Log lines it bans (from fail2ban's test suite):

WARNING: Authentication attempt from 192.0.2.0 for user "null" failed.
WARNING: Authentication attempt from 192.0.2.0 for user "null" failed.
WARNING: Authentication attempt from 192.0.2.0 for user "pippo" failed.

Show the failregex fail2ban compiles (1 line)

failregex (1)

^.*\nWARNING: Authentication attempt from <HOST> for user "[^"]*" failed\.$

Test guacamole in the browser or on the server: sudo fail2ban-regex /var/log/tomcat*/catalina.out guacamole · source

`haproxy-http-auth` HAProxy

The haproxy-http-auth filter bans clients that fail HTTP Basic authentication in front of HAProxy. File: /etc/fail2ban/filter.d/haproxy-http-auth.conf; jail [haproxy-http-auth]; log on Debian/Ubuntu: /var/log/haproxy.log.

/etc/fail2ban/jail.local

[haproxy-http-auth]
enabled  = true
logpath  = /var/log/haproxy.log

Log lines it bans (from fail2ban's test suite):

Nov 14 22:45:11 test haproxy[760]: 192.168.33.1:58430 [14/Nov/2015:22:45:11.608] main main/<NOSRV> -1/-1/-1/-1/0 401 248 - - PR-- 0/0/0/0/0 0/0 "GET / HTTP/1.1"
Nov 14 22:45:11 test haproxy[760]: 2001:db8::1234:58430 [14/Nov/2015:22:45:11.608] main main/<NOSRV> -1/-1/-1/-1/0 401 248 - - PR-- 0/0/0/0/0 0/0 "GET / HTTP/1.1"
Nov 14 22:45:11 test haproxy[760]: ::ffff:192.168.33.1:58430 [14/Nov/2015:22:45:11.608] main main/<NOSRV> -1/-1/-1/-1/0 401 248 - - PR-- 0/0/0/0/0 0/0 "GET / HTTP/1.1"

Show the failregex fail2ban compiles (1 line)

failregex (1)

^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?haproxy(?:\(\S+\))?[\]\)]?:?|[\[\(]?haproxy(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?<HOST>(?::\d+)?\s+.*<NOSRV> -1/-1/-1/-1/\+*\d* 401

Test haproxy-http-auth in the browser or on the server: sudo fail2ban-regex /var/log/haproxy.log haproxy-http-auth · source

`monit` Monit

The monit filter bans failed logins to Monit's built-in web interface. File: /etc/fail2ban/filter.d/monit.conf; jail [monit]; log on Debian/Ubuntu: /var/log/monit.

/etc/fail2ban/jail.local

[monit]
enabled  = true
port     = 2812
logpath  = /var/log/monit
           /var/log/monit.log

Log lines it bans (from fail2ban's test suite):

[PDT Apr 16 21:05:29] error : Warning: Client '69.93.127.111' supplied unknown user 'foo' accessing monit httpd
[PDT Apr 16 20:59:33] error : Warning: Client '97.113.189.111' supplied wrong password for user 'admin' accessing monit httpd
Mar 9 09:18:32 hostname monit[5731]: HttpRequest: access denied -- client 1.2.3.4: empty password
Mar 9 09:18:33 hostname monit[5731]: HttpRequest: access denied -- client 1.2.3.4: unknown user 'test1'
Mar 9 09:18:34 hostname monit[5731]: HttpRequest: access denied -- client 1.2.3.4: wrong password for user 'test2'

Show the failregex fail2ban compiles (1 line)

failregex (1)

^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?monit(?:\(\S+\))?[\]\)]?:?|[\[\(]?monit(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?(?:error\s*:\s+)?(?:Warning|HttpRequest):\s+(?:access denied\s+--\s+)?[Cc]lient '?<HOST>'?(?:\s+supplied|\s*:)\s+(?:unknown user '<F-ALT_USER>[^']+</F-ALT_USER>'|wrong password for user '<F-USER>[^']*</F-USER>'|empty password)

Test monit in the browser or on the server: sudo fail2ban-regex /var/log/monit monit · source

`grafana` Grafana

The grafana filter bans failed logins to Grafana. File: /etc/fail2ban/filter.d/grafana.conf; jail [grafana]; log on Debian/Ubuntu: /var/log/grafana/grafana.log.

/etc/fail2ban/jail.local

[grafana]
enabled  = true
port     = http,https
logpath  = /var/log/grafana/grafana.log

Log lines it bans (from fail2ban's test suite):

t=2020-10-19T17:44:33+0200 lvl=eror msg="Invalid username or password" logger=context userId=0 orgId=0 uname= error="Invalid Username or Password" remote_addr=182.56.23.12
t=2020-10-19T18:44:33+0200 lvl=eror msg="Invalid username or password" logger=context userId=0 orgId=0 uname= error="User not found" remote_addr=182.56.23.13

Show the failregex fail2ban compiles (1 line)

failregex (1)

^(?: lvl=err?or)? msg="Invalid username or password"(?: uname=(?:"<F-ALT_USER>[^"]+</F-ALT_USER>"|<F-USER>\S+</F-USER>)| error="<F-ERROR>[^"]+</F-ERROR>"| \S+=(?:\S*|"[^"]+"))* remote_addr=<ADDR>$

Test grafana in the browser or on the server: sudo fail2ban-regex /var/log/grafana/grafana.log grafana · source

`3proxy` 3proxy proxy server

The 3proxy filter bans clients that fail proxy authentication on a 3proxy server. File: /etc/fail2ban/filter.d/3proxy.conf; jail [3proxy]; log on Debian/Ubuntu: /var/log/3proxy.log.

/etc/fail2ban/jail.local

[3proxy]
enabled  = true
port     = 3128
logpath  = /var/log/3proxy.log

Log lines it bans (from fail2ban's test suite):

11-06-2013 02:09:40 +0300 PROXY.3128 00004 - 1.2.3.4:28783 0.0.0.0:0 0 0 0 GET http://www.yandex.ua/?ncrnd=2169807731 HTTP/1.1
11-06-2013 02:09:43 +0300 PROXY.3128 00005 ewr 1.2.3.4:28788 0.0.0.0:0 0 0 0 GET http://www.yandex.ua/?ncrnd=2169807731 HTTP/1.1
13-06-2013 01:39:34 +0300 PROXY.3128 00508 - 1.2.3.4:28938 0.0.0.0:0 0 0 0

Show the failregex fail2ban compiles (1 line)

failregex (1)

^\s[+-]\d{4} \S+ \d{3}0[1-9] \S+ <HOST>:\d+ [\d.]+:\d+ \d+ \d+ \d+\s

Test 3proxy in the browser or on the server: sudo fail2ban-regex /var/log/3proxy.log 3proxy · source

`webmin-auth` Webmin

The webmin-auth filter bans failed Webmin logins. File: /etc/fail2ban/filter.d/webmin-auth.conf; jail [webmin-auth]; log on Debian/Ubuntu: /var/log/auth.log.

/etc/fail2ban/jail.local

[webmin-auth]
enabled  = true
port     = 10000
logpath  = %(syslog_authpriv)s
backend  = %(syslog_backend)s

Log lines it bans (from fail2ban's test suite):

Dec 13 08:15:18 sb1 webmin[25875]: Invalid login as root from 89.2.49.230
Dec 12 23:14:19 sb1 webmin[22134]: Non-existent login as robert from 188.40.105.142
Sep 25 10:38:11 platypus webmin[27249]: Non-existent login as admin@goodeyedeer.com.au from 14.200.251.155

Show the failregex fail2ban compiles (2 lines)

failregex (2)

^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?webmin(?:\(\S+\))?[\]\)]?:?|[\[\(]?webmin(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?Non-existent login as .+ from <HOST>\s*$
^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?webmin(?:\(\S+\))?[\]\)]?:?|[\[\(]?webmin(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?Invalid login as .+ from <HOST>\s*$

Test webmin-auth in the browser or on the server: sudo fail2ban-regex /var/log/auth.log webmin-auth · source

`php-url-fopen` PHP web apps

The php-url-fopen filter bans requests that pass a remote URL as a script parameter (remote file inclusion attempts). File: /etc/fail2ban/filter.d/php-url-fopen.conf; jail [php-url-fopen]; log on Debian/Ubuntu: /var/log/nginx/*access.log.

/etc/fail2ban/jail.local

[php-url-fopen]
enabled  = true
port     = http,https
logpath  = %(nginx_access_log)s
           %(apache_access_log)s

Log lines it bans (from fail2ban's test suite):

66.185.212.172 - - [26/Mar/2009:08:44:20 -0500] "GET /index.php?n=http://eatmyfood.hostinginfive.com/pizza.htm? HTTP/1.1" 200 114 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)"

Show the failregex fail2ban compiles (1 line)

failregex (1)

^<HOST> -.*"(GET|POST).*\?.*\=http\:\/\/.* HTTP\/.*$

Test php-url-fopen in the browser or on the server: sudo fail2ban-regex /var/log/nginx/*access.log php-url-fopen · source

`centreon` Centreon Web

The centreon filter bans failed logins to the Centreon monitoring web portal. File: /etc/fail2ban/filter.d/centreon.conf; jail [centreon]; log on Debian/Ubuntu: /var/log/centreon/login.log.

/etc/fail2ban/jail.local

[centreon]
enabled  = true
port     = http,https
logpath  = /var/log/centreon/login.log

Log lines it bans (from fail2ban's test suite):

2019-10-21 18:55:15|-1|0|0|[WEB] [50.97.225.132] Authentication failed for 'admin' : password mismatch

Show the failregex fail2ban compiles (1 line)

failregex (1)

^(?:\|-?\d+){3}\|\[[^\]]*\] \[<HOST>\] Authentication failed for '<F-USER>[^']+</F-USER>'

Test centreon in the browser or on the server: sudo fail2ban-regex /var/log/centreon/login.log centreon · source

`dante` Dante SOCKS server

The dante filter bans clients that fail SOCKS authentication. File: /etc/fail2ban/filter.d/dante.conf; jail [dante]; log on Debian/Ubuntu: /var/log/daemon.log.

/etc/fail2ban/jail.local

[dante]
enabled  = true
port     = 1080
logpath  = %(syslog_daemon)s

Log lines it bans (from fail2ban's test suite):

Apr 14 15:35:03 vps111111 danted[17969]: info: block(1): tcp/accept ]: 1.2.3.4.50550 0.0.0.0.1080: error after reading 35 bytes in 0 seconds: could not access user "roooooooot"'s records in the system password file: no system error
Apr 14 15:44:26 vps111111 danted[1846]: info: block(1): tcp/accept ]: 1.2.3.4.57178 0.0.0.0.1080: error after reading 18 bytes in 0 seconds: system password authentication failed for user "aland"
Apr 14 15:44:26 vps111111 danted[1846]: info: block(1): tcp/accept ]: 1.2.3.4.57178 0.0.0.0.1080: error after reading 1 byte in 1 second: system password authentication failed for user "aland"
Apr 14 15:44:27 srv danted[3374579]: info: block(1): tcp/accept ]: 192.0.2.169.8490 192.0.2.83.52483: error after reading 31 bytes in 2 seconds: pam_authenticate() for user "socks5_user" failed: Authentication failure

Show the failregex fail2ban compiles (1 line)

failregex (1)

^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?danted(?:\(\S+\))?[\]\)]?:?|[\[\(]?danted(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?info: block\(\d\): tcp/accept \]: <ADDR>\.\d+ \S+: error after reading \d+ bytes? in \d+ seconds?: (?:could not access|system password authentication failed for|pam_authenticate\(\) for) user "<F-USER>[^"]+</F-USER>"

Test dante in the browser or on the server: sudo fail2ban-regex /var/log/daemon.log dante · source

`directadmin` DirectAdmin control panel

The directadmin filter bans failed logins to the DirectAdmin panel. File: /etc/fail2ban/filter.d/directadmin.conf; jail [directadmin]; log on Debian/Ubuntu: /var/log/directadmin/login.log.

/etc/fail2ban/jail.local

[directadmin]
enabled  = true
port     = 2222
logpath  = /var/log/directadmin/login.log

Log lines it bans (from fail2ban's test suite):

2014:07:02-00:17:45: '3.2.1.4' 2 failed login attempts. Account 'test'
2014:07:02-13:07:40: '40.40.123.231' 13 failed login attempts. Account 'admin'
2014:07:02-13:07:50: '40.40.123.231' 5 failed login attempt. Invalid account 'user%2Ename'
2014:07:02-13:29:38: '1.2.3.4' 2 failed login attempts. Account 'user' via 'admin'

Show the failregex fail2ban compiles (1 line)

failregex (1)

^: \'<HOST>\' \d{1,3} failed login attempt(s)?. \s*

Test directadmin in the browser or on the server: sudo fail2ban-regex /var/log/directadmin/login.log directadmin · source

`drupal-auth` Drupal

The drupal-auth filter bans failed Drupal logins (Drupal must log to syslog). File: /etc/fail2ban/filter.d/drupal-auth.conf; jail [drupal-auth]; log on Debian/Ubuntu: /var/log/daemon.log.

/etc/fail2ban/jail.local

[drupal-auth]
enabled  = true
port     = http,https
logpath  = %(syslog_daemon)s
backend  = %(syslog_backend)s

Log lines it bans (from fail2ban's test suite):

Apr 26 13:15:25 webserver example.com: https://example.com|1430068525|user|1.2.3.4|https://example.com/?q=user|https://example.com/?q=user|0||Login attempt failed for drupaladmin.
Apr 26 13:15:25 webserver example.com: https://example.com/subdir|1430068525|user|1.2.3.4|https://example.com/subdir/user|https://example.com/subdir/user|0||Login attempt failed for drupaladmin.
Apr 26 13:20:01 mweb drupal_site[24864]: https://www.example.com|1613058599|user|192.0.2.7|https://www.example.com/en/user/login|https://www.example.com/en/user/login|0||Login attempt failed from Jack Sparrow.
Apr 26 13:20:02 host drupal-site: https://example.com|1613063581|user|192.0.2.4|https://example.com/user/login?test=%7C&test2=%7C|https://example.com/user/login?test=|&test2=||0||Login attempt failed from 192.0.2.4.

Show the failregex fail2ban compiles (1 line)

failregex (1)

^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?\S*(?:\(\S+\))?[\]\)]?:?|[\[\(]?\S*(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?(?:https?:\/\/)[^|]+\|[^|]+\|[^|]+\|<ADDR>\|(?:[^|]*\|)*Login attempt failed (?:for|from) <F-USER>[^|]+</F-USER>\.$

Test drupal-auth in the browser or on the server: sudo fail2ban-regex /var/log/daemon.log drupal-auth · source

`froxlor-auth` Froxlor control panel

The froxlor-auth filter bans failed logins to the Froxlor server panel. File: /etc/fail2ban/filter.d/froxlor-auth.conf; jail [froxlor-auth]; log on Debian/Ubuntu: /var/log/user.log.

/etc/fail2ban/jail.local

[froxlor-auth]
enabled  = true
port     = http,https
logpath  = %(syslog_user)s
backend  = %(syslog_backend)s

Log lines it bans (from fail2ban's test suite):

2025-09-21T17:46:18.311379+02:00 hostname froxlor[1055219]: froxlor.WARNING: User tried to login with wrong password. {"source":"login","action":"50","user":"1.2.3.4"} []
2025-09-21T16:30:13.118232+02:00 hostname froxlor[1054438]: froxlor.WARNING: Unknown user tried to login. {"source":"login","action":"50","user":"1.2.3.4"} []

Show the failregex fail2ban compiles (1 line)

failregex (1)

^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?[Ff]roxlor(?:\(\S+\))?[\]\)]?:?|[\[\(]?[Ff]roxlor(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?froxlor\.WARNING: (?:Unknown )?[uU]ser(?: '<F-USER>(?:\S*|[^']*)</F-USER>')? tried to login(?: with wrong password)?\. \{(?:"[^"]+":"[^"]*",\s*){,5}"user":"<ADDR>"\} \[\]$

Test froxlor-auth in the browser or on the server: sudo fail2ban-regex /var/log/user.log froxlor-auth · source

`groupoffice` Group-Office

The groupoffice filter bans failed logins to the Group-Office groupware. File: /etc/fail2ban/filter.d/groupoffice.conf; jail [groupoffice]; log on Debian/Ubuntu: /home/groupoffice/log/info.log.

/etc/fail2ban/jail.local

[groupoffice]
enabled  = true
port     = http,https
logpath  = /home/groupoffice/log/info.log

Log lines it bans (from fail2ban's test suite):

[2014-01-06 10:59:38]LOGIN FAILED for user: "asdsad" from IP: 127.0.0.1

Show the failregex fail2ban compiles (1 line)

failregex (1)

^\[\]LOGIN FAILED for user: "\S+" from IP: <HOST>$

Test groupoffice in the browser or on the server: sudo fail2ban-regex /home/groupoffice/log/info.log groupoffice · source

`lighttpd-auth` lighttpd

The lighttpd-auth filter bans failed HTTP authentication on lighttpd. File: /etc/fail2ban/filter.d/lighttpd-auth.conf; jail [lighttpd-auth]; log on Debian/Ubuntu: /var/log/lighttpd/error.log.

/etc/fail2ban/jail.local

[lighttpd-auth]
enabled  = true
port     = http,https
logpath  = %(lighttpd_error_log)s

Log lines it bans (from fail2ban's test suite):

2011-12-25 17:09:20: (http_auth.c.875) password doesn't match for /gitweb/ username: francois, IP: 4.4.4.4
2012-09-26 10:24:35: (http_auth.c.1136) digest: auth failed for xxx : wrong password, IP: 4.4.4.4
2013-08-25 00:24:55: (http_auth.c.877) get_password failed, IP: 4.4.4.4
2018-01-16 14:10:32: (mod_auth.c.525) password doesn't match for /test-url username: test, IP: 192.0.2.1
2021-09-30 16:05:33: mod_auth.c.828) password doesn't match for /secure/ username: test IP: 192.0.2.2

Show the failregex fail2ban compiles (1 line)

failregex (1)

^[^\)]*\(?(?:http|mod)_auth\.c\.\d+\) (?:password doesn\'t match for (?:\S+|.*?) username:\s+<F-USER>(?:\S+|.*?)</F-USER>\s*|digest: auth failed(?: for\s+<F-ALT_USER>(?:\S+|.*?)</F-ALT_USER>\s*)?: (?:wrong password|uri mismatch \([^\)]*\))|get_password failed),? IP: <HOST>\s*$

Test lighttpd-auth in the browser or on the server: sudo fail2ban-regex /var/log/lighttpd/error.log lighttpd-auth · source

`monitorix` Monitorix

The monitorix filter bans failed authentication on Monitorix's built-in web server. File: /etc/fail2ban/filter.d/monitorix.conf; jail [monitorix]; log on Debian/Ubuntu: /var/log/monitorix-httpd.

/etc/fail2ban/jail.local

[monitorix]
enabled  = true
port     = 8080
logpath  = /var/log/monitorix-httpd

Log lines it bans (from fail2ban's test suite):

Wed Apr 14 08:54:22 2021 - NOTEXIST - [127.0.0.1] File does not exist: /manager/html
Wed Apr 14 11:24:31 2021 - NOTALLOWED - [127.0.0.1] Access not allowed: /monitorix/
Wed Apr 14 11:26:08 2021 - AUTHERR - [127.0.0.1] Authentication error: /monitorix/

Show the failregex fail2ban compiles (1 line)

failregex (1)

^(?:\s+-)?\s*(?:NOTEXIST|AUTHERR|NOTALLOWED) - <ADDR>\b

Test monitorix in the browser or on the server: sudo fail2ban-regex /var/log/monitorix-httpd monitorix · source

`nagios` Nagios NRPE

The nagios filter bans hosts not allowed to talk to the NRPE agent. File: /etc/fail2ban/filter.d/nagios.conf; jail [nagios]; log on Debian/Ubuntu: /var/log/daemon.log ; nrpe.cfg may define a different log_facility.

/etc/fail2ban/jail.local

[nagios]
enabled  = true
logpath  = %(syslog_daemon)s     ; nrpe.cfg may define a different log_facility
backend  = %(syslog_backend)s
maxretry = 1

Log lines it bans (from fail2ban's test suite):

Feb 3 11:22:44 valhalla nrpe[63284]: Host 50.97.225.132 is not allowed to talk to us!

Show the failregex fail2ban compiles (1 line)

failregex (1)

^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?nrpe(?:\(\S+\))?[\]\)]?:?|[\[\(]?nrpe(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?Host <HOST> is not allowed to talk to us!\s*$

Test nagios in the browser or on the server: sudo fail2ban-regex /var/log/daemon.log ; nrpe.cfg may define a different log_facility nagios · source

`openhab` openHAB

The openhab filter bans failed authentication to openHAB's web and REST API. File: /etc/fail2ban/filter.d/openhab.conf; jail [openhab-auth]; log on Debian/Ubuntu: /opt/openhab/logs/request.log.

/etc/fail2ban/jail.local

[openhab-auth]
enabled  = true
filter   = openhab
logpath  = /opt/openhab/logs/request.log
banaction = %(banaction_allports)s

Log lines it bans (from fail2ban's test suite):

175.18.15.10 - - [02/sept./2015:00:11:31 +0200] "GET /openhab.app HTTP/1.1" 401 1382
175.18.15.10 - - [02/sept./2015:00:11:31 +0200] "GET /rest/bindings HTTP/1.1" 401 1384

Show the failregex fail2ban compiles (1 line)

failregex (1)

^<HOST>\s+-\s+-\s+\[\]\s+"[A-Z]+ .*" 401 \d+\s*$

Test openhab in the browser or on the server: sudo fail2ban-regex /opt/openhab/logs/request.log openhab · source

`squid` Squid proxy

The squid filter bans clients trying to abuse a Squid proxy (denied requests, proxy bypass attempts). File: /etc/fail2ban/filter.d/squid.conf; jail [squid]; log on Debian/Ubuntu: /var/log/squid/access.log.

/etc/fail2ban/jail.local

[squid]
enabled  = true
port     = 80,443,3128,8080
logpath  = /var/log/squid/access.log

Log lines it bans (from fail2ban's test suite):

1386543323.000 4 91.188.124.227 TCP_DENIED/403 4099 GET http://www.proxy-listen.de/azenv.php - HIER_NONE/- text/html
1386543500.000 5 175.44.0.184 NONE/405 3364 CONNECT error:method-not-allowed - HIER_NONE/- text/html
1386544084.000 3 198.74.125.200 TCP_DENIED/403 3722 GET http://www2t.biglobe.ne.jp/~take52/test/env.cgi - HIER_NONE/- text/html
1386544146.000 1 175.42.91.151 TCP_DENIED/403 3745 GET http://pkfsp.ru/wp-content/uploads/proxyc/engine.php - HIER_NONE/- text/html

Show the failregex fail2ban compiles (2 lines)

failregex (2)

^\s+\d\s<HOST>\s+[A-Z_]+_DENIED/403 .*$
^\s+\d\s<HOST>\s+NONE/405 .*$

Test squid in the browser or on the server: sudo fail2ban-regex /var/log/squid/access.log squid · source

`suhosin` Suhosin PHP hardening

The suhosin filter bans clients that trigger Suhosin PHP security alerts. File: /etc/fail2ban/filter.d/suhosin.conf; jail [suhosin]; log on Debian/Ubuntu: /var/log/user.log.

/etc/fail2ban/jail.local

[suhosin]
enabled  = true
port     = http,https
logpath  = %(suhosin_log)s

Log lines it bans (from fail2ban's test suite):

Mar 11 22:52:12 lighttpd[53690]: (mod_fastcgi.c.2676) FastCGI-stderr: ALERT - configured request variable name length limit exceeded - dropped variable 'upqchi07vFfAFuBjnIKGIwiLrHo3Vt68T3yqvhQu2TqetQ78roy7Q6bpTfDUtYFR593/MA' (attacker '198.51.100.167', file '/usr/local/captiveportal/index.php')
Feb 26 22:52:29 host suhosin[9636]: ALERT - script tried to increase memory_limit to 268435456 bytes which is above the allowed value (attacker '198.51.100.77', file '/var/www/wordpress/wp-admin/includes/image.php', line 161)
Nov 18 20:18:31 platypus suhosin[28433]: ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'templatefile' (attacker '188.132.244.3', file '/home/ace-hosting/public_html/cart.php')
Oct 25 10:59:49 platypus suhosin[13953]: ALERT - configured GET variable value length limit exceeded - dropped variable '_route_' (attacker '38.111.147.83', file '/home/thegoblin/public_html/index.php')

Show the failregex fail2ban compiles (1 line)

failregex (1)

^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?(?:lighttpd|suhosin)(?:\(\S+\))?[\]\)]?:?|[\[\(]?(?:lighttpd|suhosin)(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID \d+ \S+\]\s+)?(?:\(mod_fastcgi\.c\.\d+\) FastCGI-stderr:\s)?ALERT - .*? \(attacker '<HOST>', file '[^']*'(?:, line \d+)?\)$

Test suhosin in the browser or on the server: sudo fail2ban-regex /var/log/user.log suhosin · source

`tine20` Tine 2.0 groupware

The tine20 filter bans failed logins to Tine 2.0. File: /etc/fail2ban/filter.d/tine20.conf; jail [tine20]; log on Debian/Ubuntu: /var/log/tine20/tine20.log.

/etc/fail2ban/jail.local

[tine20]
enabled  = true
port     = http,https
logpath  = /var/log/tine20/tine20.log

Log lines it bans (from fail2ban's test suite):

78017 00cff -- none -- - 2014-01-13T05:02:22+00:00 WARN (4): Tinebase_Controller::login::106 Login with username sdfsadf from 127.0.0.1 failed (-1)!
8e035 ffff3 -- none -- - 2014-01-21T04:38:14+00:00 WARN (4): Tinebase_Controller::login::106 Login with username testuser from 127.0.0.1 failed (-3)!

Show the failregex fail2ban compiles (1 line)

failregex (1)

^[\da-f]{5,} [\da-f]{5,} (-- none --|.*?)( \d+(\.\d+)?(h|m|s|ms)){0,2} -  WARN \(\d+\): Tinebase_Controller::login::\d+ Login with username .*? from <HOST> failed \(-[13]\)!$

Test tine20 in the browser or on the server: sudo fail2ban-regex /var/log/tine20/tine20.log tine20 · source

`zoneminder` ZoneMinder

The zoneminder filter bans failed logins to the ZoneMinder CCTV web console. File: /etc/fail2ban/filter.d/zoneminder.conf; jail [zoneminder]; log on Debian/Ubuntu: /var/log/apache2/*error.log.

/etc/fail2ban/jail.local

[zoneminder]
enabled  = true
port     = http,https
logpath  = %(apache_error_log)s

Log lines it bans (from fail2ban's test suite):

[Mon Mar 28 16:50:49.522240 2016] [:error] [pid 1795] [client 10.1.1.1:50700] WAR [Login denied for user "username1"], referer: https://zoneminder/
[Sun Mar 28 16:53:00.472693 2021] [php7:notice] [pid 11328] [client 10.1.1.1:39568] ERR [Could not retrieve user username1 details], referer: https://zm/zm/?view=logout
[Sun Mar 28 16:59:14.150625 2021] [php7:notice] [pid 11336] [client 10.1.1.1:39654] ERR [Login denied for user "username1"], referer: https://zm/zm/?

Show the failregex fail2ban compiles (2 lines)

prefregex

^\[\]\s\[(:?error|\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[(?:client|remote) <HOST>(:\d{1,5})?\] (?:ERR|WAR) <F-CONTENT>\[(?:Login denied|Could not retrieve).*</F-CONTENT>$

failregex (2)

^\[Login denied for user "<F-USER>[^"]*</F-USER>"\]
^\[Could not retrieve user <F-USER>\S*</F-USER>

Test zoneminder in the browser or on the server: sudo fail2ban-regex /var/log/apache2/*error.log zoneminder · source

Spotted something wrong or out of date? Tell us — every page is checked against the current fail2ban release.

guacamole Apache Guacamole

haproxy-http-auth HAProxy

monit Monit

grafana Grafana

3proxy 3proxy proxy server

webmin-auth Webmin

php-url-fopen PHP web apps

centreon Centreon Web

dante Dante SOCKS server

directadmin DirectAdmin control panel

drupal-auth Drupal

froxlor-auth Froxlor control panel

groupoffice Group-Office

lighttpd-auth lighttpd

monitorix Monitorix

nagios Nagios NRPE

openhab openHAB

squid Squid proxy

suhosin Suhosin PHP hardening

tine20 Tine 2.0 groupware

zoneminder ZoneMinder

Related pages

`guacamole` Apache Guacamole

`haproxy-http-auth` HAProxy

`monit` Monit

`grafana` Grafana

`3proxy` 3proxy proxy server

`webmin-auth` Webmin

`php-url-fopen` PHP web apps

`centreon` Centreon Web

`dante` Dante SOCKS server

`directadmin` DirectAdmin control panel

`drupal-auth` Drupal

`froxlor-auth` Froxlor control panel

`groupoffice` Group-Office

`lighttpd-auth` lighttpd

`monitorix` Monitorix

`nagios` Nagios NRPE

`openhab` openHAB

`squid` Squid proxy

`suhosin` Suhosin PHP hardening

`tine20` Tine 2.0 groupware

`zoneminder` ZoneMinder