Skip to content
Hyperion

Tune automatic bans

The brute-force scanner reads failed logins and WAF refusals on every node and bans the offending address at the firewall. You change its thresholds and ban lengths on Settings, Brute-force & GeoIP. The defaults suit most servers, so change them when you see bans that are too quick, or attacks that go unanswered.

Before you start

Section titled “Before you start”
  • You are an Owner to save. An Administrator can open the page and sees the forms disabled.
  • You know which bans you want to change. See Review, add and lift IP bans for the current ones.

Steps

Section titled “Steps”
  1. Open Settings in the sidebar, then Brute-force & GeoIP under Security.
  2. In Brute-force scanner, check the pill: scanning or off.
  3. Set the fields, then click Save.
Field Default Range Counts
Scan for login floods and ban offenders on on or off The master switch
Window 600 seconds (10 min) 1 to 86400 How far back failures count
Website login 12 2 to 10000 Failed POSTs to wp-login.php and xmlrpc.php, per site
SSH 8 2 to 10000 Failed SSH logins, node-wide
FTP 8 2 to 10000 Failed FTP logins, node-wide
Mail 8 2 to 10000 Failed mail logins, node-wide
WAF refusals 20 3 to 1000 Refusals by ban-counted WAF rules, per site
First offence 3600 seconds (1 h) 60 to 31536000 Length of a first ban
Repeat offender 86400 seconds (1 d) 60 to 31536000 Length of a ban for an address banned before
Counts as a repeat for 86400 seconds (1 d) 0 to 31536000 How far back a previous ban counts. 0 never escalates

Each seconds field shows its reading next to it, for example “= 1 h”. Hyperion saves the values to the [fail2ban] section of /etc/hyperion/agent.toml on the master and the settings sync copies the section to every node. The page tags the card All nodes. After saving, the agent on the master restarts in about 5 seconds, and the page says so.

How it counts:

  • The scanner runs every 5 minutes. It reads each site’s access.log and the node-wide SSH, FTP and mail journals.
  • Website login is the only source you can switch off for one site: Pause for this site in the Brute-force bans tile of the Security card on the hosting’s Overview tab. SSH, FTP and mail are node-wide and stay on.
  • WAF refusals count only rules that no honest visitor or crawler trips over and over: attack patterns in the URL, vulnerability scanners, sensitive WordPress files and repository and secret files. Downloads, XML-RPC, country and bot refusals never count. See Turn on the web application firewall for a site.
  • Only public, routable addresses are banned automatically. Private, loopback, CGNAT and link-local addresses are skipped, and so are the addresses of this server and of cluster nodes. You can still block any single address by hand.
  • An address already banned within Counts as a repeat for gets the Repeat offender length. The repeat length is never shorter than the first-offence length.

With the scanner switched off, nothing is scanned and care reports say “not measured” for blocked attacks. Bans added by hand still work and still expire.

Check that it worked

Section titled “Check that it worked”
  • After the agent restart, reload Brute-force & GeoIP. The fields show the numbers you saved and the pill reads scanning.
  • A notice reading “The file and the running scanner disagree.” means a value in [fail2ban] is below the floor the agent applies at start-up. Saving the form writes values that stand on their own.
  • A notice reading “agent.toml has no [fail2ban] section” means the scanner runs the built-in defaults shown in the form. Saving writes the section.
  • Over the next days, Banned now and Ban history · 7 days on the Protection page show the new behavior.

If it fails

Section titled “If it fails”
  • The forms are greyed out: only an Owner can save. Sign in as one.
  • “The master’s /etc/hyperion/agent.toml cannot be used: …”: the page shows no form because it cannot read the file. The page links to the master’s node settings, which show the raw file.
  • A value is refused on save: the message names the field and its allowed range, for example “window_secs must be 1..=86400”.
  • Bans are too slow on one service: lower that service’s threshold. A threshold of 1 is not accepted, because one mistyped password would ban the user.
Section titled “Related”