Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

It does work, like 5 times out of 3000 or so.

Running on Debian installed with apt-get and added only following jail.local file

cat jail.local

[ssh]
enabled = true
port    = ssh
filter  = sshd
logpath  = /var/log/auth.log
maxretry = 6
bantime  = 43200

When I run fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf

I get: Success, the total number of match is 9964

However my logwatch says that only 5 bans happened.

Logwatch file:

################################################################## 

 --------------------- fail2ban-messages Begin ------------------------ 

 Banned services with Fail2Ban:              Bans:Unbans
    ssh:                                                    [  5:5  ]

 ---------------------- fail2ban-messages End ------------------------- 


 --------------------- pam_unix Begin ------------------------ 

 sshd:
    Authentication Failures:
       root (219.254.35.83): 1606 Time(s)
       root (60.12.251.5): 594 Time(s)
       root (174.121.45.9): 314 Time(s)
       root (61.29.147.194): 222 Time(s)
       unknown (60.12.251.5): 146 Time(s)
       unknown (61.29.147.194): 84 Time(s)
       bin (60.12.251.5): 22 Time(s)
       backup (61.29.147.194): 8 Time(s)
       mysql (61.29.147.194): 4 Time(s)
       backup (60.12.251.5): 2 Time(s)
       news (60.12.251.5): 2 Time(s)
       mysql (60.12.251.5): 1 Time(s)
       unknown (59.175.218.166): 1 Time(s)
    Invalid Users:
       Unknown Account: 231 Time(s)
share|improve this question
add comment

1 Answer

I actually figured out what it is, or rather remembered.

I don't have iptable installed on the box so the ban never worked.

Now I switched to host.deny that should work

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.