PDA

View Full Version : Fail2ban Config Questions


batescr
30th April 2008, 17:10
I am following this how-to to install fail2ban on debian ecth.
http://www.howtoforge.com/fail2ban_debian_etch but modified it to work on CentOS.

It is working:

[root@webserver action.d]# fail2ban-client status ssh
Status for the jail: ssh
|- filter
| |- Currently failed: 0
| `- Total failed: 11
`- action
|- Currently banned: 0
| `- IP list:
`- Total banned: 3

My question is that there appears to be some type of email configuration that if a user gets banned it sends an email to the attacker. I don't know if i have that working or how that is configured.

the file /etc/fail2ban/action.d/mail.conf

falko
1st May 2008, 21:28
Looks ok, but you have actionstart and actionend twice in that file. Comment out one actionstart and one actionend directive.

batescr
1st May 2008, 22:09
The two actionstart and actionend was due to me cutting and pasting. I only have one of each. How can i test that the emails are getting sent?

falko
2nd May 2008, 16:23
You could try to break in to your server (but please use a dynamic IP address for this...).