I have a problem here where Fail2ban failed to recognize the IP, so I try to ban failed MySQL access, here are the syslog to be monitored
Sep 6 01:45:18 vps6XXXXX mysqld: 2019-09-06 1:45:18 140581192722176 [Warning] IP address '120.160.120.60' has been resolved to the host name '67.subnet120-160-120.speedy.telkom.net.id', which resembles IPv4-address itself.
Sep 6 01:45:18 vps6XXXXX mysqld: 2019-09-06 1:45:18 140581192722176 [Warning] Access denied for user 'global'@'120.160.120.60' (using password:YES)
But, fail2ban failed to read the IP address from 120.160.120.60 detected as 0.0.0.7 . The log files from fail2ban.log are as follows
2019-09-06 01:45:18,742 fail2ban.filter [3793]: WARNING Determined IP using DNS Lookup: 7 = ['0.0.0.7']
2019-09-06 01:45:18,742 fail2ban.filter [3793]: INFO [mysql] Found 0.0.0.7
Here’s my custom filter.d mysql.conf regex
[Definition]
failregex = ^.*\[Warning\] Access denied for user.*<HOST>.*\(using password: YES\)$
ignoreregex =
I’m unsure if this fail2ban fail to determine the IP or my regex fail do the job.
I would appreciate any suggestions or solutions towards this issue. Thanks.