From: Luis E. <tu...@as...> - 2007-07-23 21:27:33
|
> oops -- tty has to be ftp simply, ie > _ttys_re=(?:ssh|ftp) Ah, perfect! It works now. Thanks for the help Yaroslav! Here is what my vsftpd.conf looks like now: # Fail2Ban configuration file # Author: Cyril Jaquier # $Revision: 534 $ # Fail2Ban configuration file for generic PAM authentication errors # Author: Yaroslav Halchenko # $Revision: $ [Definition] # If you want to catch only login errors from specific daemons, use something like: #_ttys_re=(?:ssh|pro-ftpd) # # To catch all failed logins: #_ttys_re=\S* # _ttys_re=(?:ftp) # Shortcuts for easier comprehension of the failregex __pid_re=(?:\[\d+\]) __pam_re=\(?pam_unix(?:\(\S+\))?\)?:? __pam_combs_re=(?:%(__pid_re)s?:\s+%(__pam_re)s|%(__pam_re)s%(__pid_re)s?:) # Option: failregex # Notes.: regex to match the password failures messages in the logfile. # Values: TEXT # failregex = \s\S+ \S+%(__pam_combs_re)s\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=%(_ttys_re)s ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # ignoreregex = |