Впринципе заблочил SSH а вот с vsFTP проблема, не хочет((( вернее я не знаю какой лог указывать. vsFTP сконфигурирован вот так:
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
#anon_upload_enable=YES
dirmessage_enable=YES
xferlog_enable=YES
xferlog_file=/var/log/vsftpd.log
#xferlog_std_format=YES
#ascii_upload_enable=YES
#ascii_download_enable=YES
ftpd_banner=Welcome to MFOGTU FTP service.
#banned_email_file=/etc/vsftpd/banned_emails
#chroot_list_enable=YES
#chroot_list_file=/etc/vsftpd/chroot_list
#ls_recurse_enable=YES
listen=YES
#listen_ipv6=YES
pam_service_name=vsftpd
#userlist_enable=YES
tcp_wrappers=YES
chroot_local_user=YES
Лог /var/log/vsftpd.log выглядит вот так:
[root@host log]# cat /var/log/vsftpd.log
Tue Sep 21 08:30:31 2010 [pid 16264] CONNECT: Client "192.168.1.122"
Tue Sep 21 08:30:31 2010 [pid 16263] [admin] OK LOGIN: Client "192.168.1.122"
Tue Sep 21 08:58:49 2010 [pid 16480] CONNECT: Client "192.168.1.122"
Tue Sep 21 08:58:50 2010 [pid 16479] [admin] OK LOGIN: Client "192.168.1.122"
Tue Sep 21 08:58:56 2010 [pid 16481] [admin] OK UPLOAD: Client "192.168.1.122", "/Port_IP_name.doc", 107520 bytes, 2159.74Kbyte/sec
Tue Sep 21 08:58:58 2010 [pid 16481] [admin] OK DELETE: Client "192.168.1.122", "/Port_IP_name.doc"
Судя по тому какой фильтр стоит в fail2ban логи должны быть не такие.... Фильтр vsFTP:
[Definition]
failregex = vsftpd(?:\(pam_unix\))?(?:\[\d+\])?:.* authentication failure; .* rhost=<HOST>(?:\s+user=\S*)?\s*$
\[.+\] FAIL LOGIN: Client "<HOST>"\s*$
ignoreregex =
Ну и кусок конфига jail.conf
# Do not ban anybody. Just report information about the remote host.
# A notification is sent at most every 600 seconds (bantime).
[vsftpd-notification]
enabled = true
filter = vsftpd
action = sendmail-whois[name=VSFTPD, dest=root]
logpath = /var/log/vsftpd.log
maxretry = 5
bantime = 1800
# Same as above but with banning the IP address.
[vsftpd-iptables]
enabled = false
filter = vsftpd
action = iptables[name=VSFTPD, port=ftp, protocol=tcp]
sendmail-whois[name=VSFTPD, dest=root]
logpath = /var/log/vsftpd.log
maxretry = 5
bantime = 1800
вопрос откуда взять тот лог что нужен или как запустить правильно?
Все сделал) СПС за помощь! Конфиг вот такой просто надо было:
[vsftpd-notification]
enabled = true
filter = vsftpd
action = sendmail-whois[name=VSFTPD, dest=root]
logpath = /var/log/vsftpd.log
maxretry = 3
bantime = 1800
# Same as above but with banning the IP address.
[vsftpd-iptables]
enabled = true
filter = vsftpd
action = iptables[name=VSFTPD, port=ftp, protocol=tcp]
sendmail-whois[name=VSFTPD, dest=root]
logpath = /var/log/secure
maxretry = 3
bantime = 1800
