1

The fail2ban vsftpd default config doesn't take care of blocking brute force requests when tls is enabled on vsftpd.
At the moment the vsftpd log only shows the below lines which don't match the regex. Does anyone have a good regex to take care of banning?

Fri Mar  3 19:56:16 2017 [pid 19866] CONNECT: Client "39.162.209.108"
Fri Mar  3 19:56:17 2017 [pid 19868] CONNECT: Client "39.162.209.108"
0

Got it. When implicit FTP is used the vsftpd logs don't display failures as they normally do if users attempt to login without SSL. I had to add the below to the vsftpd config file file.

log_ftp_protocol=YES

Then I added the below to fail2ban's filter for vsftpd.

Client "<HOST>", "530 Non-anonymous sessions must use encryption."
Client "<HOST>", "530 Anonymous sessions must use encryption."

This will catch users who aren't aware the encryption is needed but for us it is far more likely to catch the constant brute force traffic.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.