Difference between revisions of "FAQ english"

From Fail2ban
Jump to: navigation, search
(Configuration)
(Troubleshooting: add faq about missing information - requested in gh-471)
 
(19 intermediate revisions by 16 users not shown)
Line 1: Line 1:
286a3629a0bbe2f63
+
== '''Troubleshooting''' ==
http://9.wyfexyud.com/jeb-civil-war-officer.html girls making out in the office
+
http://8.pijatheh.com/gotta-live-my-life-lyrics.html
+
http://2.chumyris.com/perfect-from-simple-plan.html perfect hack gamerzplanet
+
http://1.kuxyewus.com/anofficer-and-a-gentleman.html
+
http://1.hybijika.com/deep-vein-thrombosis-picture.html deena martin pictures
+
http://8.gijobuth.com/pepper-tree-pictures.html
+
http://10.hybijika.com/pictures-of-water-or.html pictures of water pollution in
+
http://8.cherahiv.com/american-legion-jonesboro-ga.html
+
http://10.cherahiv.com/monster-hunter-bowgun-chart.html 9137 gunnison dr dallas
+
http://9.tabadixy.com/from-watch-tv-sitcoms.html
+
http://7.moxyeche.com/linux-picture-slide-show.html lion and the mouse pictures
+
http://4.pijatheh.com/the-westlife-back-home.html
+
http://3.chumyris.com/power-america-diesel-generator-6500w-model-apg3202.html power save america
+
http://6.moxyeche.com/motion-activated-picture.html
+
http://7.kuxyewus.com/buy-one-get-one-free-book.html buy nursing textbooks
+
http://8.kuxyewus.com/midland-life-annuity.html
+
http://1.wyfexyud.com/catherine-bateson-composing-a-life.html cate blanchett life aquatic
+
http://5.chumyris.com/feng-shui-auspicious-date.html
+
http://6.cherahiv.com/of-american-foulbrood.html of american galdiators
+
http://6.wyfexyud.com/super-saver-weekly-ad.html
+
http://4.wyfexyud.com/good-housekkeping-magazine.html good fashion magazines
+
http://10.kuxyewus.com/american-general-at-the-battle-of-saratoga.html
+
http://3.pijatheh.com/free-downloadable-online-books.html free downloadable cookbooks
+
http://3.kuxyewus.com/jobs-in-bridgewater-nj.html
+
http://11.hybijika.com/white-zombie-pictures.html white witch pictures
+
http://5.kuxyewus.com/ru_winxp_pro_with_sp3_vl-iso-serial.html
+
http://6.chumyris.com/seventhday-adventist-books.html 2tb ethenet my book
+
http://3.cherahiv.com/bosan-road-college.html
+
http://1.moxyeche.com/pictures-of-alexisonfire.html pictures of alexander graham
+
http://3.hybijika.com/velvet-room-atlanta-chamblee.html
+
http://5.pijatheh.com/pictures-of-st-bernard.html pictures of sruthi
+
http://7.moxyeche.com/tokyo-flash-mens-barcode-led-watch.html
+
http://8.chumyris.com/lexington-and-concord-picture.html levonda selph picture
+
http://9.kuxyewus.com/opalka-tomato-plants.html
+
http://2.chumyris.com/excel-macro-workbook-name.html excel macro select workbook
+
http://8.chumyris.com/is-the-montreal-screwjob.html
+
http://8.wyfexyud.com/american-theocracy-by-kevin-phillips.html american themed party
+
http://8.wyfexyud.com/microsoft-corporation-office-home-and-student-2007.html
+
http://5.hybijika.com/one-week-old-marijuana-plant.html one story cottage house plans
+
http://11.wyfexyud.com/tsunami-victim-pictures.html
+
http://10.tabadixy.com/free-mobile-love-wallpaper.html koro ni wallpapers
+
http://7.kuxyewus.com/jarah-mariano-date.html
+
http://11.hybijika.com/forster-a-room-with-a-view.html for wet room shower
+
http://4.hybijika.com/enterprise-research-planning.html
+
http://3.hybijika.com/muscle-beach-wallpaper.html music art wallpaper
+
http://2.tabadixy.com/simple-wedding-plans.html
+
http://8.moxyeche.com/family-home-pictures.html allbrand picture poster
+
http://9.moxyeche.com/book-multiple-destination-flights.html
+
http://4.moxyeche.com/kanye-west-tickets-for-sale-in.html kanye west tickets la
+
http://4.cherahiv.com/pre-booked-flights.html
+
http://5.wyfexyud.com/green-plantains-in.html green planet pictures
+
http://1.moxyeche.com/huan-road-chaoyang-district.html
+
http://4.moxyeche.com/win-america-next-top-model.html 1 corinthians 13 new american
+
http://4.tabadixy.com/begur-wildlife-sanctuary.html
+
http://1.chumyris.com/baby-portabella-mushroom-recipe.html b5 in my bed room lyrics
+
http://4.tabadixy.com/buy-books-online-south-africa.html
+
http://4.hybijika.com/magazine-work-experiance.html magazine you can t touch this
+
http://9.cherahiv.com/of-insectivorous-plants.html
+
http://7.hybijika.com/scrap-book-flodder.html scrap book die cuts
+
http://11.tabadixy.com/pictures-of-golden-fish.html
+
http://2.cherahiv.com/life-magazine-history.html life magazine america the beautiful
+
http://2.pijatheh.com/bachelor-officer-and-a-gentelman.html
+
http://9.tabadixy.com/half-price-books-mentor.html half price books monroeville
+
http://7.wyfexyud.com/watches-by-hamilton.html
+
http://9.nitoqueq.com/autobiography-books-by.html autobiography books to
+
http://1.hybijika.com/all-weather-wicker-roll.html
+
http://5.cherahiv.com/picture-of-swiss-flag.html picture of suspension bridge
+
http://9.hybijika.com/que-es-un-plano-carteciano.html
+
http://4.chumyris.com/american-catechin-research.html american casualty insurance agency
+
http://10.gijobuth.com/spanish-american-war-military.html
+
http://1.wyfexyud.com/a205-s5855-battery-life.html a205 s5843 battery life
+
http://11.pijatheh.com/harvist-moon-cheats.html
+
http://11.kuxyewus.com/boyscott-of-america.html brabus north america
+
http://4.cherahiv.com/french-jobs-in-vancouver.html
+
http://4.kuxyewus.com/spring-punch-recipes.html bar drink recipies
+
http://5.nitoqueq.com/america-in-the-year-2000.html
+
http://2.kuxyewus.com/alpine-cd-changer-magazine.html entrepreneur magazine ultimate
+
http://3.nitoqueq.com/pictures-of-hue-vietnam.html
+
http://8.nitoqueq.com/life-fujisaki-masato.html life fujisaki masato
+
http://6.hybijika.com/date-format-in-my-sql.html
+
http://5.wyfexyud.com/view-private-mypsace-pictures.html view pictures on camera
+
http://9.tabadixy.com/cheep-plane-tickits.html
+
http://7.tabadixy.com/american-car-auction.html american car forum
+
http://9.chumyris.com/define-petty-officer.html
+
http://10.pijatheh.com/game-masters-magazine.html game on vibe magazine
+
http://1.pijatheh.com/stimulous-check-mailing-dates.html
+
http://6.moxyeche.com/boyne-michigan-weather.html boyne falls michigan weather
+
http://7.hybijika.com/marine-aquarium-handbook.html
+
http://11.kuxyewus.com/create-bookmarks-adobe.html create electronic books
+
http://3.nitoqueq.com/gunshot-means-forward.html
+
http://1.cherahiv.com/pima-community-college-bookstore.html pin pc2700 ddr333 notebook sodimms
+
http://3.kuxyewus.com/kitchen-remodels-ideas.html
+
http://2.gijobuth.com/hectors-dolphin-pictures.html hedonism trip pictures
+
http://10.hybijika.com/planet-organic-tottenham-court-road.html
+
http://8.tabadixy.com/jobs-in-westren-australia.html jobs in weyburn sask
+
http://7.gijobuth.com/american-fiber-glass.html
+
http://9.cherahiv.com/stafford-road-plainfield-in-46168.html staines road chertsey surrey
+
http://3.gijobuth.com/life-in-cote-d-ivoire.html
+
http://2.moxyeche.com/weirdest-places-in-america.html 10 largest american cities
+
http://1.cherahiv.com/picture-keychain-software.html
+
http://9.cherahiv.com/ideas-for-team-games.html ideas for teanagers
+
http://9.cherahiv.com/road-franklin-park-il-60131.html
+
http://1.cherahiv.com/pictures-of-laminitis.html pictures of lambos
+
http://11.nitoqueq.com/work-abroad-russia.html
+
http://9.gijobuth.com/the-colliding-planetesimals-theory.html the coffee plantation
+
http://4.wyfexyud.com/young-america-website.html
+
http://4.cherahiv.com/silver-star-pictures.html silver metal picture frame
+
http://4.hybijika.com/office-07-enterprise-blue.html
+
http://6.nitoqueq.com/printable-recipe-book.html very easy recipies
+
http://6.nitoqueq.com/tommyknockers-book-review.html
+
http://10.gijobuth.com/chinese-nuclear-power-plant.html chinatown planning council
+
http://7.chumyris.com/jervaulx-abbey-tea-rooms.html
+
http://3.kuxyewus.com/roman-name-for-asclepius.html roman empire names
+
http://4.tabadixy.com/theme-bedroom-decor.html
+
http://7.gijobuth.com/talent-search-jobs.html talk show host job
+
http://2.pijatheh.com/the-volumetric-eating-plan.html
+
http://4.nitoqueq.com/gangplank-marina-600.html ganges action plan
+
http://6.nitoqueq.com/find-jobs-in-fayetteville-nc.html
+
http://9.pijatheh.com/spook-country-book.html sport book software
+
http://11.tabadixy.com/canucks-tickets-in.html
+
  
== '''Security''' ==
+
=== I get emails containing "Here are/is more information about <ip>" and then nothing ===
  
=== What do I have to consider when using {{Fail2ban}}? ===
+
You are using a mail-whois*/sendmail-whois* action and you don't have the ''whois'' executable installed.
 
+
Especially on systems which provide SSH/CGI/PHP services to unknown users, it is possible to block other users from ssh and probably other services. How would a user do so? The user could issue:
+
 
+
logger -p auth.warning -t 'sshd[123]' 'Illegal user user1 from 1.2.3.4'
+
 
+
Or the malicious user may write via PHP's <tt>openlog()</tt>/<tt>syslog()</tt> to syslog.
+
 
+
'''Solution #1''': This security hazard can be handled via ownership/permissions of ''/dev/log'', which allows logging to all the users by default. Just add a group log, add all daemons and root to that group and be happy.
+
 
+
=== What about log injection? ===
+
 
+
{{Fail2ban}} parses log files of other services and thus it can be vulnerable to log injection. Daniel B. Cid describes this kind of issues in [http://www.ossec.net/en/attacking-loganalysis.html Attacking Log analysis tools]. I strongly suggest that you read this article. We will always try to provide safe configuration files. However, you can use '''fail2ban-regex''' to test your configuration files against forged log lines.
+
 
+
== '''Troubleshooting''' ==
+
  
 
=== I have Postfix on my system but no "mail" command. How can I get e-mail notifications? ===
 
=== I have Postfix on my system but no "mail" command. How can I get e-mail notifications? ===
Line 184: Line 50:
  
 
[[Category:Documentation]]
 
[[Category:Documentation]]
 +
 +
=== Fail2ban-client is unable to contact server ===
 +
Did you make sure to run fail2ban-client status using sudo?
 +
 +
$ fail2ban-client status
 +
ERROR  Unable to contact server. Is it running?
 +
 +
$ sudo fail2ban-client status
 +
Status
 +
|- Number of jail: 1
 +
`- Jail list: ssh
  
 
=== Fail2ban is running but not banning SSH bruteforce ===
 
=== Fail2ban is running but not banning SSH bruteforce ===
Line 201: Line 78:
 
SSH jail is set up and ready:
 
SSH jail is set up and ready:
  
  # fail2ban-client status                                           
+
  # sudo fail2ban-client status                                           
 
  Status                                                                           
 
  Status                                                                           
 
  |- Number of jail:      1                                                       
 
  |- Number of jail:      1                                                       
Line 223: Line 100:
  
 
'''If time reference is not the same everywhere, then fail2ban won't ban any IP!'''
 
'''If time reference is not the same everywhere, then fail2ban won't ban any IP!'''
 +
 +
If you change your timezone remember to restart syslogd so fail2ban will see the correct time in the log files.
 +
 +
 +
Check if backend = auto. And set backend = polling. In some cases fail2ban won't be notified by gamin, but will chose to use it when auto is set.
 +
 +
=== Fail2ban is failing to ban VSFTPD bruteforce ===
 +
'''Scenario:''' VSFTP configuration is set for PAM authentication, using xferlog in standard format.  Fail2ban for vsftpd is watching /var/log/secure
 +
*'''Problem:'''  PAM sends failed login information to /var/log/secure, but the remote server's IP address has been replaced by a DNS name.  Resulting DNS name does not resolve or does not resolve correctly, thus fail2ban is unable to ban the IP address.
 +
*'''Fix:''' Configure VSFTP for "dual_log_enable=YES", and have fail2ban watch /var/log/vsftpd.log instead.  This log file shows the incoming ip address instead of the DNS name.
 +
 +
'''Scenario:''' Timestamps in /var/log/vsftpd.log are in GMT instead of the local time zone.
 +
*'''Problem:''' Fail2ban won't ban if the timestamps it finds don't match its idea of the current time.
 +
*'''Fix:''' Add "use_localtime=YES" to /etc/vsftpd/vsftpd.conf and restart the vsftpd service.
 +
'''NB''': This will also cause file timestamps in directory listings and other timestamps displayed to clients to be in your local time zone. If this is unacceptable, then you may wish to configure fail2ban to monitory /var/log/secure, whose timestamps are in the local time zone, but this may cause other problems as described above.

Latest revision as of 12:48, 4 December 2013

Troubleshooting

I get emails containing "Here are/is more information about <ip>" and then nothing

You are using a mail-whois*/sendmail-whois* action and you don't have the whois executable installed.

I have Postfix on my system but no "mail" command. How can I get e-mail notifications?

As of version 0.8.1, "mail" actions are deprecated. Please use the "sendmail" ones instead. E.g. sendmail-whois instead of mail-whois in your jail.[conf|local].

You probably have the sendmail command. Copy /etc/fail2ban/action.d/mail-whois.conf to /etc/fail2ban/action.d/mail-whois.local, edit this file and replace mail with sendmail. Here is an example:

actionban = echo -en "From:root <fail2ban>
            To: <dest>
            Subject: [Fail2Ban] <name>: banned <ip>
            Hi,\n
            The IP <ip> has just been banned by Fail2Ban after
            <failures> attempts against <name>.\n\n
            Here are more information about <ip>:\n
            `whois <ip>`\n
            Regards,\n
            Fail2Ban"|sendmail -t  

mail.conf can be modified too.

Why do my CVS users using SSH getting blocked?

If you are using the Eclipse CVS integration with SSH, then each access of the CVS results in a failed access before a valid one is done. As a consequence your CVS users get banned from time to time.

I get the error "Please check the format and your locale settings"

The error looks like this:

ERROR: time data did not match format: data=Mar 21 10:00:50 fmt=%b %d %H:%M:%S
ERROR: Please check the format and your locale settings.

This is a known bug. Since 0.6.1, Fail2ban uses your locale settings for date and time format. However, some daemons do not take care of locale and write their log messages using the POSIX standard. Please look at this bug for more details.

You can try to override the LANG variable:

# LANG=en_US /etc/init.d/fail2ban restart

You can get all the available locale with:

# locale -a

How do I increase verbosity?

In order to increase the verbosity of Fail2ban, use the command line option -vvv for fail2ban-client and fail2ban (only for 0.6.x). Set loglevel to 4 in /etc/fail2ban/fail2ban.conf (only for > 0.6.x).

Fail2ban-client is unable to contact server

Did you make sure to run fail2ban-client status using sudo?

$ fail2ban-client status
ERROR  Unable to contact server. Is it running?

$ sudo fail2ban-client status
Status
|- Number of jail:	1
`- Jail list:		ssh

Fail2ban is running but not banning SSH bruteforce

NB:This example is based on a Debian system, but can be easily done on any distro.

The package is well installed:

# dpkg -l |grep fail                                               
ii  fail2ban                      0.8.1-2                         bans IPs that 
cause multiple authentication

The service is running:

# /etc/init.d/fail2ban status                                      
Status of authentication failure monitor: fail2ban is running

SSH jail is set up and ready:

# sudo fail2ban-client status                                           
Status                                                                          
|- Number of jail:      1                                                       
`- Jail list:           ssh

SSH bruteforce logs are identified by fail2ban:

# fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf
....
Success, the total number of match is 30

So, check that all your logs are synchronized: all logs files (auth.log, syslog,..) must use the same time reference (if your server is not very busy, there will probably be an important difference between the output of [1]date command and the last event logged in syslog. You can force to generate a log in syslog using the logger command and check then with the output of date command)

# date                                                             
Wed Nov 28 13:49:02 CET 2007                                                    
# tail -2 /var/log/auth.log                                        
Nov 28 13:39:12 <SERVERNAME> sudo: pam_unix(sudo:session): session opened for user roo
t by <user>(uid=0)                                                              
Nov 28 13:39:12 <SERVERNAME> sudo: pam_unix(sudo:session): session closed for user roo
t

If time reference is not the same everywhere, then fail2ban won't ban any IP!

If you change your timezone remember to restart syslogd so fail2ban will see the correct time in the log files.


Check if backend = auto. And set backend = polling. In some cases fail2ban won't be notified by gamin, but will chose to use it when auto is set.

Fail2ban is failing to ban VSFTPD bruteforce

Scenario: VSFTP configuration is set for PAM authentication, using xferlog in standard format. Fail2ban for vsftpd is watching /var/log/secure

  • Problem: PAM sends failed login information to /var/log/secure, but the remote server's IP address has been replaced by a DNS name. Resulting DNS name does not resolve or does not resolve correctly, thus fail2ban is unable to ban the IP address.
  • Fix: Configure VSFTP for "dual_log_enable=YES", and have fail2ban watch /var/log/vsftpd.log instead. This log file shows the incoming ip address instead of the DNS name.

Scenario: Timestamps in /var/log/vsftpd.log are in GMT instead of the local time zone.

  • Problem: Fail2ban won't ban if the timestamps it finds don't match its idea of the current time.
  • Fix: Add "use_localtime=YES" to /etc/vsftpd/vsftpd.conf and restart the vsftpd service.

NB: This will also cause file timestamps in directory listings and other timestamps displayed to clients to be in your local time zone. If this is unacceptable, then you may wish to configure fail2ban to monitory /var/log/secure, whose timestamps are in the local time zone, but this may cause other problems as described above.