From: Rarig, H. <hr...@so...> - 2006-03-16 22:57:54
|
Yaroslav, Yeah, the thought crossed my mind that maybe I ought to do a little more = than just "cat" the fail2ban.log file...;-). I certainly would enjoy = doing this sometime in the future, but right now my stack is overflowing = big time with too many other commitments! On the other hand, my experience has been that very few robots are = attacking my site via FTP, and when they do the "magic" in vsftpd seems = to do a good job regulating the frequency of the attempts. However, = once they get past this, the 25 authentications per second dictionary = attacks that were plaguing me in the past have completely ceased now = that fail2ban is guarding the entrance to the castle! (Nice work guys!) As far as SSH goes, I am using the iptables "recent" option to manage = that (see http://olivier.sessink.nl/publications/blacklisting/index.html = [Note: replace "extern_in" with "INPUT" and "extern-out" with = "OUTPUT"]). Using this, the banned IPs show up automatically in the = logwatch default ssh and kernel reports. Would be interested in hearing some anecdotal reports from the field = about how many entries other subscribers to this mailing list are seeing = in their fail2ban.log files...?? =20 Are entries in your fail2ban.log file on the order of 1 or 2, dozens, = hundreds, or more? Cheers! Harry -----Original Message----- From: fai...@li... [mailto:fai...@li...]On Behalf Of Yaroslav Halchenko Sent: Thursday, March 16, 2006 4:54 PM To: fai...@li... Subject: Re: [Fail2ban-users] Add fail2ban to your logwatch daily report Dear Harry, Thank you for logwatch scripts -- I was looking toward composing ones myself but never got to them ;-) Wouldn't you like to see a summary like VSFTPD: 12 IPs baned [list of IPs may be] SSH: 3 IPs baned [...] Another possibility would be to include for each IP on how many times it = was banned which would signal that bantime might be too low if you have multiple hits for the same IP If you have any spare moment, since you mastered logwatch already, would you mind writing a script to provide such statistics? Otherwise you just might get lengthy list of WARNINGs and I really think that statistics would be a better presentation of relevant information --=20 .-. =3D------------------------------ /v\ ----------------------------=3D Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting = language that extends applications into web and mobile media. Attend the live = webcast and join the prime developer group breaking into this new coding = territory! http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D110944&bid=3D241720&dat=3D= 121642 _______________________________________________ Fail2ban-users mailing list Fai...@li... https://lists.sourceforge.net/lists/listinfo/fail2ban-users |