Fail2ban problems reddit / selfhosted ---------------------------------------------------------------------- Skatespeare · 2023-12-23 13:16 Hello selfhosting community, I have a problem with setting up fail2ban with Nginx Proxy Manager and Cloudflare and I hope you can help me. I'm a newbie with this stuff so sorry for that. I hope I give the right information. So I've been trying to get fail2ban to work on my home server and Cloudflare. I want to ban connections after three failed logins. It works on some of my subdomains but not all. I think it has to do with the way the regex file is set up, but I'm not sure. The first three give a 401 or a 304 error, but only the first one actually bans the client ip. The fourth example is the Home Assistant login page. When I enter a wrong password it returns a 200 code, so it makes sense it doens't trigger fail2ban. But when I do enter the right account information I also get a 200 code. Why doesn't HA return an error code when the login fails? And with Transmission I get banned after entering CORRECT information. I guess my question is: how do I set up fail2ban so that it covers ALL failed logins on my domains? Failregex: ^.+" (4\d\d|3\d\d) (\d\d\d|\d) .+$ ^.+ 4\d\d \d\d\d - .+ \[Client \] \[Length .+\] ".+" .+$ This works. It bans client 12.345.6.78. It's the login page from Jellyfin: username@raspberrypi:~/NPM/data/logs $ tail -f proxy- host-1_access.log [23/Dec/2023:13:14:29 +0100] - 401 401 - POST https jelly.mydomain.nl "/Users/authenticatebyname" [Client 12.345.6.78] [Length 25] [Gzip -] [Sent-to 192.168.1.6] "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Mobile Safari/537.36" "-" This doensn't work. It's my webserver (Nginx), protected by NPM Access List with htaccess: username@raspberrypi:~/NPM/data/logs $ tail -f proxy- host-2_access.log [23/Dec/2023:13:18:44 +0100] - - 401 - GET https www.mydomain.nl "/" [Client 12.345.6.78] [Length 578] [Gzip -] [Sent-to 192.168.1.6] "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Mobile Safari/537.36" "-" [23/Dec/2023:13:18:47 +0100] - - 401 - GET https www.mydomain.nl "/" [Client 12.345.6.78] [Length 578] [Gzip -] [Sent-to 192.168.1.6] "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Mobile Safari/537.36" "-" This doesn't work either. It's the login page from Calibre Web: username@raspberrypi:~/NPM/data/logs $ tail -f proxy- host-3_access.log [23/Dec/2023:13:26:56 +0100] - 200 200 - POST https calibreweb.mydomain.nl "/login?next=%2F" [Client 12.345.6.78] [Length 1656] [Gzip 2.68] [Sent-to 192.168.1.6] "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Mobile Safari/537.36" "https://calibreweb.mydomain.nl/login?next=%2F" [23/Dec/2023:13:26:57 +0100] - 304 304 - GET https calibreweb.mydomain.nl "/static/favicon.ico" [Client 12.345.6.78] [Length 0] [Gzip -] [Sent-to 192.168.1.6] "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Mobile Safari/537.36" "https://calibreweb.mydomain.nl/login?next=%2F" This doens't work either. It's the Home Assistant login page. I suppose it makes sense cause there is no 4\*\* or 3\*\* error code. But why not? It's a failed login: username@raspberrypi:~/NPM/data/logs $ tail -f proxy- host-4_access.log [23/Dec/2023:13:34:57 +0100] - 200 200 - POST https ha.mydomain.nl "/auth/login_flow/9b523c26c8d8bb8c23423ffb4face6a7" [Client 12.345.6.78] [Length 221] [Gzip -] [Sent-to 192.168.1.6] "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Mobile Safari/537.36" "-" This one bans me after I give a CORRECT login. It's Transmission web, protected by NPM Access List with htaccess. This is only part of the log. It returns many lines with either 200, 301 or 409 codes: username@raspberrypi:~/NPM/data/logs $ tail -f proxy- host-5_access.log [23/Dec/2023:13:49:23 +0100] - 409 409 - POST https transmission.mydomain.nl "/transmission/rpc" [Client 12.345.6.78] [Length 581] [Gzip -] [Sent-to 192.168.1.6] "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Mobile Safari/537.36" "https://transmission.mydomain.nl/transmission/web/" My second problem: The ip's are banned through CloudFlare which works. When they are unbanned automatically after a period of time they get removed from the CloudFlare list. However, when I remove them by hand from CloudFlare and I restart the fail2ban docker container, they are automatically banned again. How do I keep them unbanned when I remove them from CloudFlare? Sorry for the long post. And thanks in advance for any help you are able to give me. ---------------------------------------------------------------------- tylersprice · 2023-12-23 15:35 Don't rely on return codes. Setup fail2ban on each services logs instead of trying to use 1 rule in npm logs. Look for specific phrases like "login denied" or whatever. ---------------------------------------------------------------------- Skatespeare · 2023-12-24 20:00 Thanks, I will give that a try.