I've added some regex rules for sshd and want to ban all users in /var/log/secure that match this regex within the jail rules (3 attempts, 24 hours).

But I do not want to wait for them to try again, I want them banned now.

How would I achieve this?


Older versions reprocessed the log on restart. Newer versions store the last log-file position to a sqlite db. When the check sum of up to the first line not modified matches what was stored it won't process those lines again.

You can modify some part of the log before that point so the checksum fails and it will all get processed again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.