oui, normalement ça marche toujours, et pour les entrées dans auth.log, elles me semblent a peu pres pareil.
Par ex, les logs de mon pote, qui est banni sont bien :
Mar 23 21:36:51 valinor sshd[27702]: Invalid user bbob from xx.168.169.xx
Mar 23 21:36:51 valinor sshd[27702]: Failed none for invalid user bbob from xx.168.169.xx port 53209 ssh2
Mar 23 21:37:00 valinor sshd[27702]: pam_unix(sshd:auth): check pass; user unknown
Mar 23 21:37:00 valinor sshd[27702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=rke29-1-xx-168-169-xx.fbx.proxad.net
Mar 23 21:37:02 valinor sshd[27702]: Failed password for invalid user bbob from xx.168.169.xx port 53209 ssh2
et
pour un mec pas banni :
Mar 23 09:28:32 valinor sshd[14096]: Invalid user kankova from 173.45.64.202
Mar 23 09:28:32 valinor sshd[14096]: pam_unix(sshd:auth): check pass; user unknown
Mar 23 09:28:32 valinor sshd[14096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ca.40.2d.static.xlhost.com
Mar 23 09:28:34 valinor sshd[14096]: Failed password for invalid user kankova from 173.45.64.202 port 53422 ssh2
[^] # Re: Lignes ERROR
Posté par Gart Algar . En réponse au message fail2ban ne ban pas (enfin pas souvent). Évalué à 1.
Par ex, les logs de mon pote, qui est banni sont bien :
Mar 23 21:36:51 valinor sshd[27702]: Invalid user bbob from xx.168.169.xx
Mar 23 21:36:51 valinor sshd[27702]: Failed none for invalid user bbob from xx.168.169.xx port 53209 ssh2
Mar 23 21:37:00 valinor sshd[27702]: pam_unix(sshd:auth): check pass; user unknown
Mar 23 21:37:00 valinor sshd[27702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=rke29-1-xx-168-169-xx.fbx.proxad.net
Mar 23 21:37:02 valinor sshd[27702]: Failed password for invalid user bbob from xx.168.169.xx port 53209 ssh2
et
pour un mec pas banni :
Mar 23 09:28:32 valinor sshd[14096]: Invalid user kankova from 173.45.64.202
Mar 23 09:28:32 valinor sshd[14096]: pam_unix(sshd:auth): check pass; user unknown
Mar 23 09:28:32 valinor sshd[14096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ca.40.2d.static.xlhost.com
Mar 23 09:28:34 valinor sshd[14096]: Failed password for invalid user kankova from 173.45.64.202 port 53422 ssh2
bref, un gros mystère pour moi :(