3

It does work, like 5 times out of 3000 or so.

Running on Debian installed with apt-get and added only following jail.local file

cat jail.local

[ssh]
enabled = true
port    = ssh
filter  = sshd
logpath  = /var/log/auth.log
maxretry = 6
bantime  = 43200

When I run fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf

I get: Success, the total number of match is 9964

However my logwatch says that only 5 bans happened.

Logwatch file:

################################################################## 

 --------------------- fail2ban-messages Begin ------------------------ 

 Banned services with Fail2Ban:              Bans:Unbans
    ssh:                                                    [  5:5  ]

 ---------------------- fail2ban-messages End ------------------------- 


 --------------------- pam_unix Begin ------------------------ 

 sshd:
    Authentication Failures:
       root (219.254.35.83): 1606 Time(s)
       root (60.12.251.5): 594 Time(s)
       root (174.121.45.9): 314 Time(s)
       root (61.29.147.194): 222 Time(s)
       unknown (60.12.251.5): 146 Time(s)
       unknown (61.29.147.194): 84 Time(s)
       bin (60.12.251.5): 22 Time(s)
       backup (61.29.147.194): 8 Time(s)
       mysql (61.29.147.194): 4 Time(s)
       backup (60.12.251.5): 2 Time(s)
       news (60.12.251.5): 2 Time(s)
       mysql (60.12.251.5): 1 Time(s)
       unknown (59.175.218.166): 1 Time(s)
    Invalid Users:
       Unknown Account: 231 Time(s)

1 Answer 1

4

I actually figured out what it is, or rather remembered.

I don't have iptable installed on the box so the ban never worked.

Now I switched to host.deny that should work

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .