I rarely have any attempts on SSH since I moved it to another port. BUT I jsut tried to anonymously log in via FTP 5x and found this in auth.log:
Feb 17 00:15:04 h2118175 pure-ftpd: (?@85.214.249.219) [WARNING] Authentication failed for user [anonymous]
So that is ok and indeed in fail2ban.log I see:
Quote:
2013-02-17 00:15:15,780 fail2ban.filter : DEBUG /var/log/syslog has been modified
2013-02-17 00:15:15,795 fail2ban.filter : DEBUG Found 85.214.249.219
|
The settings for this jail are:
Quote:
[pureftpd]
enabled = true
port = ftp
filter = pure-ftpd
logpath = /var/log/syslog
maxretry = 3
findtime = 86400
|
So I should have been blocked :-(