fail2ban对SSH管用但proftpd不管用不知道为何.

ATOM

我已经错误登录FTP几十次了.还是不行.
Use regex file : /etc/fail2ban/filter.d/proftpd.conf
Use log file   : /var/log/secure


Results
=======

Failregex
|- Regular expressions:
|  [1] \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to                                              \S+:\S+$
|  [2] \(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): Incorrect password\.$
|  [3] \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\.$
|  [4] \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded$
|
`- Number of matches:
   [1] 0 match(es)
   [2] 0 match(es)
   [3] 0 match(es)
   [4] 0 match(es)

Ignoreregex
|- Regular expressions:
|
`- Number of matches:

Summary
=======

Sorry, no match
已解决,正确的规则是

1. failregex = \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[[0-9.]+\] to \S+:\S+\s*$
   
2.             \(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): Incorrect password\.\s+$
   
3.             \(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): No such user found\.\s+$
   
4.             \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\.\s+$
   
5.             \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded\s+$

复制代码

[ 本帖最后由 ATOM 于 2010-7-29 21:49 编辑 ]

ATOM

有碰到过的吗?

cnx

我虽然安装了，但是不怎么使用。

诡谲

你要指定proftp日志路径和一些FTP错误代码。[url=http://www.google.com/search?q=fail2ban+proftpd&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-USfficial&client=firefox-a]善用Google[/url]

[ 本帖最后由 诡谲 于 2010-7-29 21:16 编辑 ]

iamfly

对VSFTP是管用的