From: Cyril J. <cyr...@bl...> - 2006-01-09 09:59:48
|
Hi, Fail2ban must find the IP address in the same line as "authentication failed". Sorry :( Maybe you can adjust log output in the SSH server settings!? "last message repeated 2 times" is syslog daemon dependant. For syslog-ng, look at: http://groups.google.com/group/comp.unix.bsd.freebsd.misc/browse_thread/thread/88f35008d8afeab8/f169ff9475dbd3b6 Regards, Cyril Menno Alkemade wrote: > Hi, > > i'm trying to get fail2ban running on our servers, it seems to run but not > detecting the failed logins. We are using the non-commercial version of the > ssh.com sshd (not my choice) and getting the following results of a failed > login in our logs: > > Jan 5 09:44:52 XXXXX sshd[280]: [ID 702911 auth.info] connection from > "xx.xx.xx.xx" > Jan 5 09:44:54 XXXXX sshd[25932]: [ID 702911 auth.warning] password > authentication failed. Login to account root not allowed or account non-existent. > Jan 5 09:45:02 XXXXX last message repeated 2 times > > Is it still possible for fail2ban to ban an IP while there is no IP in the > "authentication failed" line ? And is there a way around the "last message > repeated 2 times" ? > > regards, > > Menno Alkemade > > -- > Sapienza Consulting LTD > > > > ------------------------------------------------------- > This SF.net email is sponsored by: Splunk Inc. Do you grep through log files > for problems? Stop! Download the new AJAX search engine that makes > searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! > http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users > |