Назад | Перейти на главную страницу

fail2ban не может заблокировать auth.log с помощью directadmin

Я использую directadmin на сервере Ubuntu. Я недавно установил Fail2Ban. но я все еще получаю электронное письмо от directadmin о «атаке методом перебора». мой jail.conf (только тюрьмы auth.log!):

[ssh]
enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 6

[pam-generic]
enabled  = false
filter   = pam-generic
port     = all
banaction = iptables-allports
port     = anyport
logpath  = /var/log/auth.log
maxretry = 6

[ssh-ddos]
enabled  = false
port     = ssh
filter   = sshd-ddos
logpath  = /var/log/auth.log
maxretry = 6

мой auth.log (частично):

Mar 12 05:31:29 server sshd[24203]: Invalid user justin from 59.148.193.108
Mar 12 05:31:29 server sshd[24203]: input_userauth_request: invalid user justin [preauth]
Mar 12 05:31:29 server sshd[24203]: pam_unix(sshd:auth): check pass; user unknown
Mar 12 05:31:29 server sshd[24203]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=059148193108.ctinets.com 
Mar 12 05:31:31 server sshd[24203]: Failed password for invalid user justin from 59.148.193.108 port 36573 ssh2
Mar 12 05:31:31 server sshd[24203]: Received disconnect from 59.148.193.108: 11: Bye Bye [preauth]

Mar 12 07:38:29 server sshd[30093]: reverse mapping checking getaddrinfo for 221.51.174.61.dial.wz.zj.dynamic.163data.com.cn [61.174.51.221] failed - POSSIBLE BREAK-IN ATTEMPT!
Mar 12 07:38:30 server sshd[30093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.174.51.221  user=admin
Mar 12 07:38:32 server sshd[30093]: Failed password for admin from 61.174.51.221 port 4413 ssh2
Mar 12 07:38:44 server sshd[30093]: message repeated 5 times: [ Failed password for admin from 61.174.51.221 port 4413 ssh2]
Mar 12 07:38:44 server sshd[30093]: Disconnecting: Too many authentication failures for admin [preauth]
Mar 12 07:38:44 server sshd[30093]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.174.51.221  user=admin
Mar 12 07:38:44 server sshd[30093]: PAM service(sshd) ignoring max retries; 6 > 3

Я где-то читал, что это может иметь какое-то отношение к формату даты. но после расследования они исправили это в новых версиях fail2ban.