# Fail2ban jail not working - backend? **URL:** \ **Category:** Rocky Linux Help & Support\ **Created:** [October 28, 2023, 5:15pm UTC](https://forums.rockylinux.org/t/fail2ban-jail-not-working-backend/11708 "2023-10-28T17:15:07Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Mikheil](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/mikheil/32/2054_2.png) [@Mikheil](https://forums.rockylinux.org/u/Mikheil)\ **Post date:** [October 28, 2023, 5:15pm UTC](https://forums.rockylinux.org/t/fail2ban-jail-not-working-backend/11708/1 "2023-10-28T17:15:07Z")
I’m tired of linodeusercontent attempting to hack my server. I don’t care if it’s benign or not. I’m sick of them I created a filter in /etc/fail2ban/filter.d/linodeuser.conf ```auto [Definition] failregex = .*googleusercontent.* ignoreregex = ``` I then created a jail,in /etc/fail2ban/jail.local ```auto [apache-linode] enabled = true filter = linodeuser logpath = /var/log/secure maxretry = 3 bantime = -1 action = %(action_mw)s destemail = root@localhost ``` Fail2ban loads, no errors all the other jails work fine, but fail2ban-client test linodeuser gives nme an error and all I can glean ids thet the error message has something to do with the backend (which is set to auto) Can anyone shed light? ---
**Author:** ![LinuxGuy1997](https://avatars.discourse-cdn.com/v4/letter/l/d26b3c/32.png) [@LinuxGuy1997](https://forums.rockylinux.org/u/LinuxGuy1997)\ **Post date:** [October 30, 2023, 2:05pm UTC](https://forums.rockylinux.org/t/fail2ban-jail-not-working-backend/11708/2 "2023-10-30T14:05:26Z")
Exactly what is the error being reported? Which version of Rocky Linux and fail2ban are in use? Without any of these details, the best suggestion I have is for you to change your backend setting from “auto” to “systemd” then restart the fail2ban service – that was required on CentOS 7 before things would work… ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [October 30, 2023, 3:20pm UTC](https://forums.rockylinux.org/t/fail2ban-jail-not-working-backend/11708/3 "2023-10-30T15:20:25Z")
What are backends for fail2ban? Aren’t there basically two sets: - The logs that it reads for events (systemd has journald, but the syslog is still around) - How firewall is updated (ruleset is in kernel, but to talk directly or to FirewallD – if directly, it should be nftables-based) ---
**Author:** ![Mikheil](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/mikheil/32/2054_2.png) [@Mikheil](https://forums.rockylinux.org/u/Mikheil)\ **Post date:** [October 30, 2023, 4:21pm UTC](https://forums.rockylinux.org/t/fail2ban-jail-not-working-backend/11708/4 "2023-10-30T16:21:17Z")
When I start the Fail2ban server, it starts fine. All the built in jails are working that are eligible most are apache For example > [apache-noscript] > enabled = true > port = http,https > logpath = %(apache\_error\_log)s > maxretry = 3 > bantime = -1 > action = %(action\_mw)s > destemail = root@localhost There is no error BUT in the logwatch log thatere are pages and pages of errors and the jail doesn’t work. I tried changing the backend to systemd by adding the line backend - systemd in that jail and it had no effect. I’ve also picked up another problem I’d like a jail for. My Logwatch this morning showed 52 x 404 errors with files ending in .php. Yesterday was 37 I have jail for 404 errors and it’s set to 2 retries and I catch dozens, so it works for sure… All the attempts to access files ending in .php only had one single attempt. If the same people do this every day? I doubt even a jail to stop .php errors, if they only make one attempt it won’t stop them, but it does suck up a load of bandwidth. Is there any other way to stop these idiots. ---
**Author:** ![Mikheil](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/mikheil/32/2054_2.png) [@Mikheil](https://forums.rockylinux.org/u/Mikheil)\ **Post date:** [October 31, 2023, 3:55pm UTC](https://forums.rockylinux.org/t/fail2ban-jail-not-working-backend/11708/5 "2023-10-31T15:55:30Z")
> [@Mikheil](#): > > ```auto > [Definition] > failregex = .*googleusercontent.* > ignoreregex = > > ``` Solved it. - Missing quotes should be: ```auto [Definition] failregex = '.*linodeusercontent.*' ignoreregex = ``` Logpath goes in jail.local - doesn’t matter what it is as long as it’s the correct one. I used logpath = %(apache\_access\_log)s I also did the same for binaryedge.ninja. Google ones are OK ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\ **Post date:** [December 30, 2023, 3:56pm UTC](https://forums.rockylinux.org/t/fail2ban-jail-not-working-backend/11708/6 "2023-12-30T15:56:10Z")
Closed on December 30, 2023, 3:56pm UTC This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.