[Fail2ban-users] Filter sshd-root not working for us

2015-06-23 Thread David Highley
_DIFFERENT_DOMAINS,RCVD_IN_DNSWL_HI,RCVD_IN_MSPIKE_H3, > RCVD_IN_MSPIKE_WL,SPF_HELO_PASS,SPF_PASS,T_RP_MATCHES_RCVD autolearn=ham > autolearn_force=no version=3.4.1 > X-ACL-Warn: > From: David Highley > Message-Id: <201506231410.t5neaucb004...@douglas.highley-r

[Fail2ban-users] Filter sshd-root not working for us

2015-06-23 Thread David Highley
We are not able to tell if the sshd-root filter is even being invoked. It does block after three bad attempts at logging in. We are running on Fedora 22 systems. Also we have been able to get the email to work. We are new to using fail2ban. Here is our jail file: # # WARNING: heavily refactored in

Re: [Fail2ban-users] Fail2ban 0.9.1 does not ban anymore

2015-02-06 Thread David Highley
"Davide Perini wrote:" You did not provide any information about what your running this on. If the host is using firewalld you might need to use this action file, firewallcmd-new. > > When I start fail2ban I can see this error now: > > Feb 06 22:10:21 netstar.acme.org fail2ban.actions[850]: NOT

Re: [Fail2ban-users] Question on creating a filter

2015-02-02 Thread David Highley
ion as well (which can include backend = systemd). There isn't > > really enough info here for me to help too much more - I don't have any > > systems using systemd. The only binary logs I have are on my Windows > > machines. > > > > On 02/02/2015 03:38

Re: [Fail2ban-users] Fwd: fail2ban sendmail returned 7e00

2015-01-22 Thread David Highley
hoose from 2 high performing configs, both with 100TB of bandwidth. > Higher redundancy.Lower latency.Increased capacity.Completely compliant. > http://p.sf.net/sfu/gigenet > --===2623532880364256023== > Content-Type: text/plain; charset="us-ascii" > MIME-Version: 1.0 > Content-Transfer-Encoding

Re: [Fail2ban-users] Question on creating a filter

2015-01-18 Thread David Highley
host. Fail2ban will not # ban a host which matches an address in this list. Several addresses can be # defined using space separator. ignoreip = 127.0.0.1/8 10.2.2.0/255.255.255.0 130.76.32.0/255.255.255.0 130.76.64.0/255.255.255.0 [sshd] enabled = true #filter = sshd-root > > On 01

[Fail2ban-users] Question on creating a filter

2015-01-17 Thread David Highley
We found this filter on the web which is supposed to block root ssh logins: [INCLUDES] # Read common prefixes. If any customizations available -- read them from # common.local before = common.conf [Definition] _daemon = sshd failregex = ^%(__prefix_line)sFailed (?:password|publickey) for root