How to make Fail2Ban block bad protocol in auth.log?

D

Dim Boy2015-12-20 09:59:14

System administration

Dim Boy, 2015-12-20 09:59:14

I changed the ssh port, now there are fewer forwardings in auth.log, but these are the ones left (a lot of the same ip):

sshd[21061]: Did not receive identification string from 177.94.136.61
sshd[25933]: Bad protocol version identification 'guest' from 118.41.56.148 port 59853

Active filters

ssh
ssh-ddos
ssh-route
ssh-iptables-ipset4

Reply

Answer the question

In order to leave comments, you need to log in

2 answer(s)

S

sim3x, 2015-12-20
@sim3x

Tip https://github.com/fail2ban/fail2ban/issues/332
https://darrynvt.wordpress.com/tag/custom-fail2ban... www.fail2ban.org/wiki/index.php/Fail2ban:Community
. ..

D

Dim Boy, 2015-12-22
@twix007

Changed in /etc/fail2ban/filter.d/sshd-ddos.conf:
on the
I'm waiting for the result in the logs.
https://github.com/fail2ban/fail2ban/issues/332
again...
sshd[14773]: Did not receive identification string from 110.166.179.192