Re: [Fail2ban-users] failed login detection problem

[Cyril J. <cyr...@bl...>]

Hi,

Fail2ban must find the IP address in the same line as "authentication
failed". Sorry :(

Maybe you can adjust log output in the SSH server settings!?

"last message repeated 2 times" is syslog daemon dependant. For
syslog-ng, look at:

http://groups.google.com/group/comp.unix.bsd.freebsd.misc/browse_thread/thread/88f35008d8afeab8/f169ff9475dbd3b6

Regards,

Cyril


Menno Alkemade wrote:
> Hi,
> 
> i'm trying to get fail2ban running on our servers, it seems to run but not
> detecting the failed logins. We are using the non-commercial version of the
> ssh.com sshd (not my choice) and getting the following results of a failed
> login in our logs:
> 
> Jan  5 09:44:52 XXXXX sshd[280]: [ID 702911 auth.info] connection from
> "xx.xx.xx.xx"
> Jan  5 09:44:54 XXXXX sshd[25932]: [ID 702911 auth.warning] password
> authentication failed. Login to account root not allowed or account non-existent.
> Jan  5 09:45:02 XXXXX last message repeated 2 times
> 
> Is it still possible for fail2ban to ban an IP while there is no IP in the
> "authentication failed" line ? And is there a way around the "last message
> repeated 2 times" ?
> 
> regards,
> 
> Menno Alkemade
> 
> --
> Sapienza Consulting LTD
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
> _______________________________________________
> Fail2ban-users mailing list
> Fai...@li...
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>