Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

He guys, i run CentOS5.6 (final), and i just installed FAIL2BAN version (0.8.4-23.el5).

I have set it up to ban SSH and VSFTPD attacks.

As you can see here: fail2ban has started correctly, inspecting 2 logs files. I checked the paths, both are correct.

Now fail2ban has already blocked a few SSH intruders, but it does not seem to wanna block VSFTPD intruders.

When i check the vsftpd logs in realtime, some ips keep slamming my server with wrong logins about every second. So those guys should have been banned already.

I tested fail2ban's vsftpd feature with this command: fail2ban-regex /var/log/vsftpd.log /etc/fail2ban/filter.d/vsftpd.conf

It all seems to be working just fine, output of the test:

I already tried: use_localtime=YES and dual_log_enable=YES in vsftpd.conf


jail.conf: (vsftpd part)

failregex = vsftpd(?:\(pam_unix\))?(?:\[\d+\])?:.* authentication failure; .* rhost=<HOST>(?:\s+user=\S*)?\s*$
            \[.+\] FAIL LOGIN: Client "<HOST>"\s*$

Does anyone know why fail2ban is not banning my vsftpd attackers?

share|improve this question
up vote 0 down vote accepted

I managed to get it working by using: /var/log/secure also for the VSFTPD log reading. Although the normal VSFTPD logs should also work, as they output similar data. The real problem here must be the failregex. But with the /var/log/secure it works.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.