I yesterday installed fail2ban on my server and I see I am not getting logs for the genuine people also who log in to my machine.In /var/log/auth.log
It is a Ubuntu server and I had installed fail2ban via apt-get install I thought some thing might be in /var/log/fail2ban.log
but there I do not see any thing
2011-02-10 20:26:35,002 fail2ban.server : INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.4
2011-02-10 20:26:35,003 fail2ban.jail : INFO Creating new jail 'ssh'
2011-02-10 20:26:35,003 fail2ban.jail : INFO Jail 'ssh' uses poller
2011-02-10 20:26:35,031 fail2ban.filter : INFO Added logfile = /var/log/auth.log
2011-02-10 20:26:35,032 fail2ban.filter : INFO Set maxRetry = 6
2011-02-10 20:26:35,033 fail2ban.filter : INFO Set findtime = 600
2011-02-10 20:26:35,034 fail2ban.actions: INFO Set banTime = 600
2011-02-10 20:26:35,127 fail2ban.jail : INFO Jail 'ssh' started
2011-02-10 21:02:22,323 fail2ban.jail : INFO Jail 'ssh' stopped
2011-02-10 21:02:22,324 fail2ban.server : INFO Exiting Fail2ban
2011-02-10 21:02:22,677 fail2ban.server : INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.4
2011-02-10 21:02:22,678 fail2ban.jail : INFO Creating new jail 'ssh'
2011-02-10 21:02:22,678 fail2ban.jail : INFO Jail 'ssh' uses poller
2011-02-10 21:02:22,695 fail2ban.filter : INFO Added logfile = /var/log/auth.log
2011-02-10 21:02:22,695 fail2ban.filter : INFO Set maxRetry = 6
2011-02-10 21:02:22,697 fail2ban.filter : INFO Set findtime = 600
2011-02-10 21:02:22,697 fail2ban.actions: INFO Set banTime = 600
2011-02-10 21:02:22,788 fail2ban.jail : INFO Jail 'ssh' started
The entries in jail.local are
[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip = 127.0.0.1 192.168.0.0/24
bantime = 600
maxretry = 5
and
[ssh]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 6
[ssh-ddos]
enabled = false
port = ssh
filter = sshd-ddos
logpath = /var/log/auth.log
maxretry = 6
What more can I check?
