Я использую directadmin на сервере Ubuntu. Я недавно установил Fail2Ban. но я все еще получаю электронное письмо от directadmin о «атаке методом перебора». мой jail.conf (только тюрьмы auth.log!):
[ssh]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 6
[pam-generic]
enabled = false
filter = pam-generic
port = all
banaction = iptables-allports
port = anyport
logpath = /var/log/auth.log
maxretry = 6
[ssh-ddos]
enabled = false
port = ssh
filter = sshd-ddos
logpath = /var/log/auth.log
maxretry = 6
мой auth.log (частично):
Mar 12 05:31:29 server sshd[24203]: Invalid user justin from 59.148.193.108
Mar 12 05:31:29 server sshd[24203]: input_userauth_request: invalid user justin [preauth]
Mar 12 05:31:29 server sshd[24203]: pam_unix(sshd:auth): check pass; user unknown
Mar 12 05:31:29 server sshd[24203]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=059148193108.ctinets.com
Mar 12 05:31:31 server sshd[24203]: Failed password for invalid user justin from 59.148.193.108 port 36573 ssh2
Mar 12 05:31:31 server sshd[24203]: Received disconnect from 59.148.193.108: 11: Bye Bye [preauth]
Mar 12 07:38:29 server sshd[30093]: reverse mapping checking getaddrinfo for 221.51.174.61.dial.wz.zj.dynamic.163data.com.cn [61.174.51.221] failed - POSSIBLE BREAK-IN ATTEMPT!
Mar 12 07:38:30 server sshd[30093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.174.51.221 user=admin
Mar 12 07:38:32 server sshd[30093]: Failed password for admin from 61.174.51.221 port 4413 ssh2
Mar 12 07:38:44 server sshd[30093]: message repeated 5 times: [ Failed password for admin from 61.174.51.221 port 4413 ssh2]
Mar 12 07:38:44 server sshd[30093]: Disconnecting: Too many authentication failures for admin [preauth]
Mar 12 07:38:44 server sshd[30093]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.174.51.221 user=admin
Mar 12 07:38:44 server sshd[30093]: PAM service(sshd) ignoring max retries; 6 > 3
Я где-то читал, что это может иметь какое-то отношение к формату даты. но после расследования они исправили это в новых версиях fail2ban.