# SECURITY RISK: Intrusion Detection Turns Itself Off

**URL:** https://forums.vitalpbx.org/t/security-risk-intrusion-detection-turns-itself-off/4093
**Category:** VitalPBX 4
**Created:** [May 16, 2024, 2:31pm UTC](https://forums.vitalpbx.org/t/security-risk-intrusion-detection-turns-itself-off/4093 "2024-05-16T14:31:25Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![dbaum22101](https://forums.vitalpbx.org/letter_avatar_proxy/v4/letter/d/2acd7d/32.png) [@dbaum22101](https://forums.vitalpbx.org/u/dbaum22101)
#### Post date: [May 16, 2024, 2:31pm UTC](https://forums.vitalpbx.org/t/security-risk-intrusion-detection-turns-itself-off/4093/1 "2024-05-16T14:31:25Z")

</div>

Since upgrade to Vital PBX 4.1.0-3 I have observed the Intrusion Detection Stopped message on the Dashboard. I go to Firewall settings and the toggle is off. I turn it on, and get the Firewall Changes Saved Message. Then I go to Dashboard and the Intrusion Detection Stopped message is present Then I return to Firewall Settings and the toggle is off again. I have restarted the Vital PBX virtual machine twice and this continues to happen.  
I noticed there was a string on this under VitalPBX 3 in the forum but no definitive reason or solution was provided.

---

<div class="post-metadata">

### Author: ![miguel](https://forums.vitalpbx.org/user_avatar/forums.vitalpbx.org/miguel/32/415_2.png) [@miguel](https://forums.vitalpbx.org/u/miguel)
#### Post date: [May 17, 2024, 12:49pm UTC](https://forums.vitalpbx.org/t/security-risk-intrusion-detection-turns-itself-off/4093/2 "2024-05-17T12:49:33Z")

</div>

Have you go to the Linux CLI to check if there’s an issue with the Fail2Ban service?

The Linux CLI will always be your friend in this cases.

---

<div class="post-metadata">

### Author: ![dbaum22101](https://forums.vitalpbx.org/letter_avatar_proxy/v4/letter/d/2acd7d/32.png) [@dbaum22101](https://forums.vitalpbx.org/u/dbaum22101)
#### Post date: [May 19, 2024, 7:51pm UTC](https://forums.vitalpbx.org/t/security-risk-intrusion-detection-turns-itself-off/4093/3 "2024-05-19T19:51:07Z")

</div>

Miguel I did not see any error messages but i will try again to turn Intrusion Detection On and watch it go off while watching the Linux CLI

---

<div class="post-metadata">

### Author: ![dbaum22101](https://forums.vitalpbx.org/letter_avatar_proxy/v4/letter/d/2acd7d/32.png) [@dbaum22101](https://forums.vitalpbx.org/u/dbaum22101)
#### Post date: [May 19, 2024, 7:57pm UTC](https://forums.vitalpbx.org/t/security-risk-intrusion-detection-turns-itself-off/4093/4 "2024-05-19T19:57:43Z")

</div>

Miguel, I executed the systemctl start fail2ban and the the fail2ban-client status and received an error message:

root@mercury66:~# systemctl start fail2ban  
root@mercury66:~# fail2ban-client status  
2024-05-19 15:56:25,266 fail2ban [627930]: ERROR Failed to access socket path: /var/run/fail2ban/fail2ban.sock. Is fail2ban running?  
root@mercury66:~#  
– Executing [s@cos-

---

<div class="post-metadata">

### Author: ![dbaum22101](https://forums.vitalpbx.org/letter_avatar_proxy/v4/letter/d/2acd7d/32.png) [@dbaum22101](https://forums.vitalpbx.org/u/dbaum22101)
#### Post date: [May 19, 2024, 9:21pm UTC](https://forums.vitalpbx.org/t/security-risk-intrusion-detection-turns-itself-off/4093/5 "2024-05-19T21:21:25Z")

</div>

Attachign logs to this if possible

---

<div class="post-metadata">

### Author: ![dbaum22101](https://forums.vitalpbx.org/letter_avatar_proxy/v4/letter/d/2acd7d/32.png) [@dbaum22101](https://forums.vitalpbx.org/u/dbaum22101)
#### Post date: [May 19, 2024, 9:22pm UTC](https://forums.vitalpbx.org/t/security-risk-intrusion-detection-turns-itself-off/4093/6 "2024-05-19T21:22:25Z")

</div>

Guess attachments are not possible. Should I open a paid support ticket Miguel?