> Hi again
> Yes, it works! But it needed changing my jail.local also; that solved the
> problem. Debian etch version didn't
> work even changing jail.local. Keep reading.
etch version doesn't have right failregex so you would need to override
it in filters.d/vsftpd.local
taking it from sid version
> They come from /var/log/vsftpd.log
right - that is what I placed in jail.conf: /var/log/vsftpd.log so you
don't have to override it in jail.local -- you just have to enable it
(ie enabled=true)
>, where they're mixed with successful logins. Yes, the pid # is a vsftpd one.
> This is quite strange... I also thought those login attempts should be in
> auth.log, and that vsftpd.log should contain
> only succesful logins. Well, that did the trick: using /var/log/vsftpd log in
> my jail.conf instead of /var/log/auth.log.
> I don't know if it's been my mistake, but I don't rememeber changing that in
> fail2ban 0.6, and it was working. ¿?
0.6 (up to the very last one) had my rules which were using
/var/log/vsftpd.log not auth.log.
> Well, not too far... Fail2ban has been working fine till 0.7 version with a
> custom vsftpd configuration. Vsftpd debian
> packages are compiled without PAM support, so I compile the author's package
> (nothing special, besides the PAM change).
that explains missing lines in auth.log using original failregex shipped
upstream ;-)
So do you have vsftpd with PAM support? then you must have failed login entries
in
auth.log, right? how do they look?
Now I think it would be better to ship fail2ban with 2 jails - vsftpd
(uses /var/log/vsftpd.log and corresponding failregex) and
vsftpd-pam (uses upstream failregex and /var/log/auth.log). Could you
please provide me with entries produced in auth.log with pam enabled
vsftpd?
--
.-.
=------------------------------ /v\ ----------------------------=
Keep in touch // \\ (yoh@|www.)onerussian.com
Yaroslav Halchenko /( )\ ICQ#: 60653192
Linux User ^^-^^ [175555]
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
