Как заставить Fail2Ban блокировать bad protocol в auth.log?

Question

[Dim Boy]

Сменил порт ssh, в auth.log теперь меншьше пробросов, но остались вот ети (много одинаковьіх ip):

sshd[21061]: Did not receive identification string from 177.94.136.61
sshd[25933]: Bad protocol version identification 'guest' from 118.41.56.148 port 59853

Активньіе фильтрьі

ssh
ssh-ddos
ssh-route
ssh-iptables-ipset4

Answer 1

[sim3x]

Наводка https://github.com/fail2ban/fail2ban/issues/332

https://darrynvt.wordpress.com/tag/custom-fail2ban...
www.fail2ban.org/wiki/index.php/Fail2ban:Community...

Answer 2

[Dim Boy]

Поменял в /etc/fail2ban/filter.d/sshd-ddos.conf:

failregex = ^%(__prefix_line)sDid not receive identification string from <HOST>\s*$

на

failregex = ^%(__prefix_line)s(Did not receive identification string|Bad protocol version identification '.*') from <HOST>\s*$

Жду результат в логах.
https://github.com/fail2ban/fail2ban/issues/332

опять...
sshd[14773]: Did not receive identification string from 110.166.179.192