I am setting up fail2ban for various services. Ssh went smoothly, but I have had no success with vsftpd so far. The problem is, that I can't find a way to get failed login attempts to appear in the logs. I see nothing in auth.log nor in vsftpd.log.
In the example here: http://www.fail2ban.org/wiki/index.php/Vsftpd there are several lines which should appear in the various logs but they don't.
Here is what I have in the conf now:
listen=YES anonymous_enable=NO local_enable=YES write_enable=YES dirmessage_enable=YES use_localtime=YES xferlog_enable=YES dual_log_enable=YES xferlog_std_format=NO xferlog_file=/var/log/vsftpd.log session_support=YES connect_from_port_20=YES chroot_local_user=YES userlist_deny=NO userlist_enable=YES userlist_file=/etc/vsftpd.allowed_users secure_chroot_dir=/var/run/vsftpd/empty pam_service_name=vsftpd rsa_cert_file=/etc/ssl/private/vsftpd.pem ssl_enable=YES allow_anon_ssl=NO force_local_data_ssl=YES force_local_logins_ssl=YES ssl_tlsv1=YES ssl_sslv2=YES ssl_sslv3=YES
In the logs I only see successful logins, but when the client gets a 530 permission denied, nothing is logged.
I would prefer not to log the entire FTP chat.
Using Ubuntu 10.04.