Extra Systems Ban Software (ESBANS)

Author: Yurii Pavlenko
Company: Extra Systems
Year of development: 2026
Contacts: esbans@extrasystems.biz

Introduction

The problem of server security on the Internet was relevant yesterday, is relevant today, and will remain relevant tomorrow. First of all, it is essential to have reliable components on the server, apply security updates on time, and avoid configuration errors. However, even if you have done all of this, hordes of hackers are still attacking your system every minute — for example, attempting to brute-force passwords for one service or another. In addition, such attacks consume server resources and force it to waste effort processing these useless requests.

Therefore, systems were developed to ban intruders based on specific signs of hacker activity. This website describes the use for this purpose of the well-known component for Linux servers called fail2ban (with our additional modules, which significantly increase its operational efficiency), as well as an original system created by us to protect the RDP port on Windows servers, named ES-RDP.

Components of the ESBANS System

The ESBANS system includes our original filters for fail2ban (which demonstrate much higher practical efficiency than standard fail2ban filters with the same purpose), the ES-RDP system for protecting the RDP port on Windows Server, and components for monitoring the operation of this entire system via a web interface.

Filters for fail2ban

For fail2ban (which today we consider a "must have" class system for Linux-based servers), we have developed the following original high-efficiency filters to suppress hackers:

es-nginx-access - filter for neutralizing hackers in the nginx WEB server
es-nginx-errors - filter for neutralizing hackers in the nginx WEB server
es-bind-errors - filter for neutralizing hackers in the bind DNS server
es-postfix - filter for neutralizing hackers in the postfix mail server
es-phpBB - filter for neutralizing hackers on the phpBB forum
es-wordpress - filter for neutralizing hackers on WordPress hosting
es-sql-injection - filter for protecting the server against SQL injections
es-ocis - filter for protecting the ownCloud cloud storage system against hackers

All these filters also use standard fail2ban settings from the [DEFAULT] section during their operation, which in our case looks as follows:

[DEFAULT]
ignoreip = 127.0.0.1/8 192.168.0.0/24
port     = all
maxretry = 3
findtime = 6h
bantime  = 1d

ES-RDP — Remote Desktop protection system for Windows Server

ES-RDP is a comprehensive solution for protecting the Remote Desktop Protocol service in a Windows Server environment. The system focuses on automating the threat detection process and dynamically managing access rules.

On the hard drive, our ES-RDP system directory looks as follows:

20.04.2026  11:48             2 073 common.ps1
17.04.2026  09:47               136 rdp-run.bat
17.04.2026  17:55             2 415 rdp-run.ps1
14.04.2026  18:11               120 rdp_log.bat
16.04.2026  22:40             1 165 rdp_log.php
20.04.2026  12:14             6 535 rdp_log.ps1
09.04.2026  11:24               403 set_log_size.bat
30.03.2026  14:58                55 stat_all.bat
23.04.2026  09:23            12 208 stat_all.ps1
               9 files          25 110 bytes

Our original RDP port protection system for Windows Server consists of the following elements:

common - shared system settings file used by all its main and additional elements
rdp-run - the main active element of the system, which detects intruders and performs their primary blocking
rdp_log - an additional active element of the system that unblocks hosts and networks whose ban duration has expired, and also searches for repeat offenders and botnet address blocks for their subsequent secondary blocking
rdp_ban - MySQL database required for the operation of the entire system
stat_all - the main passive element of the system, providing output of the full protection system status to the console upon administrator request
set_log_size - an auxiliary element that allows changing the maximum log file size

ES-RDP was developed by us and successfully applied on Windows Server 2012 R2. Unfortunately, at present, we do not have any reliable information regarding its compatibility with other versions of Windows Server. At the same time, since our code does not use any undocumented features, it would be reasonable to assume that it will also work in subsequent versions of this operating system.

Server Protection System Monitoring Block

Monitoring the status of the ESBANS system is carried out by the administrator via a simple web interface. To do this, you need to create a dedicated site in nginx on your Linux server or create a special directory on an existing site. A special script, which is launched via cron every hour, will generate the esbans_stat.htm file in the corresponding directory, which can be reviewed on your workstation via any web browser. This HTML file displays the activity of the fail2ban and ES-RDP modules over the last few days in the form of charts (this parameter can be customized to your needs).

In addition, another monitoring tool (for ES-RDP only, not the entire ESBANS) is the above-mentioned stat_all module.

Conclusion

The system for protecting Linux and Windows-based Internet servers developed by us and presented here for your attention has already shown excellent results in our network, and we hope that the results of its application in your networks will also bring great satisfaction to your system administrators. We also hope that after applying ESBANS, hackers and spammers will steer clear of all your servers, as has long been the case with ours.

Extra Systems retains all rights to all code published on this website. At the same time, we grant permission to any person to use it on their servers without any restrictions, as well as to modify and supplement it. Sale of our code, including code modified by anyone, is not allowed. Distribution of the original or modified code is permitted only if a link to the original source is provided.

The content of this page is also available in Russian.