FAQ english

From Fail2ban
Revision as of 00:42, 4 January 2007 by Lostcontrol (Talk | contribs) (How to ask for help or submit a bug report?)

Jump to: navigation, search


What is Fail2ban?

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address. These rules can be defined by the user. Fail2ban can read multiple log files such as sshd or Apache web server ones.

Is Fail2ban free software?

Fail2ban is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

What do you need to run Fail2ban?

Take a look at Requirements section

How to ask for help or submit a bug report or a feature request?

First of all, try to find an answer on this website. Read the FAQ, Manual and visit HOWTOs. Search the mailing lists archives and look at the trackers. If you did not found any answer, subscribe to this mailing list and ask your question there. Registration is required in order to avoid spam.

If you are convinced that you found a bug, you can directly create a new ticket here.

If you want to submit a feature request, create a new ticket here.

In both cases, please check first that no similar bug or request has already been submitted.

In any case, when asking for support, please provide the following information:

  • The version of Fail2ban you are running (use -V or --version)
  • The version of Python
  • How you installed Fail2ban (sources, .deb, .rpm, etc)
  • Relevant parts of the configuration files of Fail2ban
  • Logging output of Fail2ban using the DEBUG mode (-vvv and loglevel = 4)

And of course, do not forget to describe clearly your problem.


Are there RPM/DEB packages for Fail2ban?

Sure. Please take a look at Downloads section

How can I install Fail2ban from a RPM/DEB/gentoo package?

If you are using rpm:

rpm -ivh fail2ban-X.X.X.rpm

If you are required to install a src.rpm (source package) please follow these instructions:

rpm --rebuild fail2ban-X.X.X.src.rpm

After that, binary rpm will be placed at /usr/src/RPM/RPMS/ix86

rpm -ihv /usr/src/RPM/RPMS/ix86/fail2ban-X.X.X.rpm

Please check that your PATH is /usr/src/RPM/RPMS/ix86/ before doing anything else.

If you want to install Fail2ban from a .deb package:

dpkg -i fail2ban-X.X.X.deb

If you want to install Fail2ban on gentoo:

emerge fail2ban


What is the main configuration file for Fail2ban?

Fail2ban configuration process is rather simple. There is only one configuration file, where Fail2ban can be whole configurated, this file is located at: /etc/fail2ban.conf

You are able to edit this file using any editor we want: vim, emacs, joe, ae...

Configuration file must be edited by root

How can Fail2ban be configured?

This step is fully detailed at HOWTOs chapter

Can I exclude failed logins for selected users from resulting in a ban?

(I don't know, perhaps that's a feature request.)


What do I have to consider when using Fail2ban

Especially on systems wich provide ssh/CGI/PHP services to unknown users it is possible to block other users from ssh and probably other access as a unprivileged user may issue:

logger -p auth.warning -t 'sshd[123]' 'Illegal user user1 from'

Or the malicious user may write via PHP's openlog()/syslog() to syslog.

Solution #1: This security hazard can be handled via ownership/permissions of /dev/log, which allows logging to all the users by default. Just add a group log, add all daemons, and root to that group and be happy.


I have Postfix on my system but no "mail" command. How can I get e-mail notifications?

You have probably the sendmail command. Copy /etc/fail2ban/action.d/mail-whois.conf to /etc/fail2ban/action.d/mail-whois.local, edit this file and replace mail with sendmail. Here is an example:

actionban = echo -en "From:root <fail2ban>
            To: <dest>
            Subject: [Fail2Ban] <name>: banned <ip>
            The IP <ip> has just been banned by Fail2Ban after
            <failures> attempts against <name>.\n\n
            Here are more information about <ip>:\n
            `whois <ip>`\n
            Fail2Ban"|sendmail -t  

mail.conf can be modified too.

Why do my CVS users using SSH getting blocked?

If your are using the Eclipse CVS integration with SSH, then each access of the CVS results in a failed access before a valid one is done. As a consequence your CVS users get banned from time to time.

I get the error "Please check the format and your locale settings"

The error looks like this:

ERROR: time data did not match format: data=Mar 21 10:00:50 fmt=%b %d %H:%M:%S
ERROR: Please check the format and your locale settings.

This is a known bug. Since 0.6.1, Fail2ban uses your locale settings for date and time format. However, some daemons do not take care of locale and write their log messages using the POSIX standard. Please look at this bug for more details.

You can try to override the LANG variable:

# LANG=en_US /etc/init.d/fail2ban restart

You can get all the available locale with:

# locale -a