From: Anton Kvashin <foo@junior.esoo.ru>
To: ALT Linux sysadmins' discussion <sysadmins@lists.altlinux.org>
Subject: Re: [Sysadmins] Fail2ban не ловит мышей.
Date: Thu, 20 Sep 2012 16:30:26 +0600
Message-ID: <505AF042.4010108@junior.esoo.ru> (raw)
In-Reply-To: <CAC4WpAx=eo6NLBmW2WELuifLJZgkfyPf2Wi-cY-_j7gv=sNTOg@mail.gmail.com>
20.09.2012 16:08, Dmitriy Kruglikov пишет:
> 20 сентября 2012 г., 12:39 пользователь Anton Kvashin написал:
>
>> А что там в iptables, ip попадает в цепочки?
>
> # iptables-save | grep fail2ban
> :fail2ban-LigHTTPd - [0:0]
> -A INPUT -j fail2ban-LigHTTPd
> -A fail2ban-LigHTTPd -j RETURN
>
> ip не попадает в цепочки. В логах fail2ban нет ни каких записей о
> факте срабатывания правила.
> Такое впечатление, что fail2ban не следит за логом.
> Хотя, в логе fail2ban есть упоминания о том, что
> 2012-09-20 12:07:50,918 fail2ban.filter : DEBUG
> /var/lib/vz/root/220/var/log/lighttpd/access.log has been modified
> 2012-09-20 12:07:50,918 fail2ban.filter : DEBUG Found 91.197.218.6
> 2012-09-20 12:07:50,918 fail2ban.filter.datedetector: DEBUG Sorting
> the template list
Можно попробовать на другом сервисе, например, ssh. Т.е. с коробочными
failregex.
--
Anton Kvashin
next prev parent reply other threads:[~2012-09-20 10:30 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-09-20 8:24 Dmitriy Kruglikov
2012-09-20 9:39 ` Anton Kvashin
2012-09-20 10:08 ` Dmitriy Kruglikov
2012-09-20 10:30 ` Anton Kvashin [this message]
2012-09-21 6:02 ` Dmitriy Kruglikov
2012-09-26 11:43 ` Денис Смирнов
2012-09-26 11:46 ` Dmitriy Kruglikov
2012-09-29 18:44 ` Евгений Терешков
2012-09-30 8:59 ` Dmitriy Kruglikov
2012-09-30 9:33 ` Денис Смирнов
2012-09-30 10:24 ` Евгений Терешков
2012-09-30 10:54 ` Dmitriy Kruglikov
2012-09-30 9:34 ` Денис Смирнов
2012-09-30 10:56 ` Евгений Терешков
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=505AF042.4010108@junior.esoo.ru \
--to=foo@junior.esoo.ru \
--cc=sysadmins@lists.altlinux.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
ALT Linux sysadmins discussion
This inbox may be cloned and mirrored by anyone:
git clone --mirror http://lore.altlinux.org/sysadmins/0 sysadmins/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 sysadmins sysadmins/ http://lore.altlinux.org/sysadmins \
sysadmins@lists.altlinux.org sysadmins@lists.altlinux.ru sysadmins@lists.altlinux.com
public-inbox-index sysadmins
Example config snippet for mirrors.
Newsgroup available over NNTP:
nntp://lore.altlinux.org/org.altlinux.lists.sysadmins
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git