I'm not an expert with fail2ban. I am currently using version 0.11 and I used the information from https://blog.shanock.com/fail2ban-increased-ban-times-for-repeat-offenders/ to setup my jails. I actually just used that without modification. Will post here in thread as well as I'm sure that link might get complaints ;)
# Fail2Ban configuration file for subsequent bans # [INCLUDES] before = common.conf [Definition] failregex = \]\s+Unban\s+<HOST> ignoreregex = \[f2b-loop.*\]\s+Unban\s+<HOST> # # Author: Walter Heitman Jr. http://blog.shanock.com [DEFAULT] bantime = 10m findtime = 1h maxretry = 5 [f2b-loop2] enabled = true filter = f2b-loop bantime = 1h findtime = 3h logpath = /var/log/fail2ban.log maxretry = 2 [f2b-loop3] enabled = true filter = f2b-loop bantime = 3h findtime = 1d logpath = /var/log/fail2ban.log maxretry = 3 [f2b-loop4] enabled = true filter = f2b-loop bantime = 1d findtime = 1w logpath = /var/log/fail2ban.log maxretry = 7 [f2b-loop5] enabled = true filter = f2b-loop bantime = 1w findtime = 1mo logpath = /var/log/fail2ban.log maxretry = 11 That's what I am using and they are placed in and named /etc/fail2ban/filter.d/f2b-loop.conf /etc/fail2ban/jail.d/f2b-loop.local Respectively. Now this is not in reference to the question I saw in the subject of line of this received mail, but I thought it a good time to show what I am using, and have some of the experts take a look for validity, as well as possibly supplying the config for others to use. I did not write those. They are being attributed to the link I posted above as well as the attribution in the comment. Thanks, Ron -- Ronald L.Johnson [email protected] 628.202.2396 On Sun, Dec 20, 2020 at 2:38 PM James Moe via Fail2ban-users < [email protected]> wrote: > On 12/19/20 3:51 PM, Dan Egli wrote: > > > As an example, I have the following filter, among others, in my > > exim.local.conf file: > > fixed_login_exim4u authenticator failed for .* <HOST> > > > Show us the jail conf and filter. > > -- > James Moe > moe dot james at sohnen-moe dot com > 520.743.3936 > Think. > > > _______________________________________________ > Fail2ban-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/fail2ban-users >
_______________________________________________ Fail2ban-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/fail2ban-users
