Настройка fail2ban для vsftpd

Question

[yorm]

CentOS 6. Логи в последние дни растут ежесекундно, fail2ban не справляется.

/var/log/secure:

May 25 00:48:18 localhost fail2ban.filter : WARNING Unable to find a corresponding IP address for cable-181-133-26-174.une.net.co: [Errno -2] Name or service not known
May 25 00:48:18 localhost fail2ban.filter : WARNING Unable to find a corresponding IP address for cable-181-133-26-174.une.net.co: [Errno -2] Name or service not known
May 25 00:48:18 localhost fail2ban.filter : WARNING Unable to find a corresponding IP address for cable-181-133-26-174.une.net.co: [Errno -2] Name or service not known
May 25 00:48:18 localhost fail2ban.filter : WARNING Unable to find a corresponding IP address for cable-181-133-26-174.une.net.co: [Errno -2] Name or service not known
May 25 00:48:18 localhost fail2ban.filter : WARNING Unable to find a corresponding IP address for cable-181-133-26-174.une.net.co: [Errno -2] Name or service not known

— 45 строк за 1 секунду, а секунд много.

/var/log/messages

May 25 00:48:02 localhost vsftpd[20600]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=test123 rhost=201-211-198-200.genericrev.cantv.net 
May 25 00:48:02 localhost vsftpd[20600]: pam_succeed_if(vsftpd:auth): error retrieving information about user test123
May 25 00:48:07 localhost vsftpd[20602]: pam_unix(vsftpd:auth): check pass; user unknown
May 25 00:48:07 localhost vsftpd[20602]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=test123 rhost=201-211-198-200.genericrev.cantv.net 
May 25 00:48:07 localhost vsftpd[20602]: pam_succeed_if(vsftpd:auth): error retrieving information about user test123
May 25 00:48:37 localhost vsftpd[20604]: pam_unix(vsftpd:auth): check pass; user unknown
May 25 00:48:37 localhost vsftpd[20604]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=test123 rhost=201-211-198-200.genericrev.cantv.net 
May 25 00:48:37 localhost vsftpd[20604]: pam_succeed_if(vsftpd:auth): error retrieving information about user test123
May 25 00:48:42 localhost vsftpd[20606]: pam_unix(vsftpd:auth): check pass; user unknown
May 25 00:48:42 localhost vsftpd[20606]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=test123 rhost=201-211-198-200.genericrev.cantv.net 
May 25 00:48:42 localhost vsftpd[20606]: pam_succeed_if(vsftpd:auth): error retrieving information about user test123
May 25 00:48:48 localhost vsftpd[20608]: pam_unix(vsftpd:auth): check pass; user unknown
May 25 00:48:48 localhost vsftpd[20608]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=test123 rhost=201-211-198-200.genericrev.cantv.net 
May 25 00:48:48 localhost vsftpd[20608]: pam_succeed_if(vsftpd:auth): error retrieving information about user test123

/etc/fail2ban/jail.conf:

[vsftpd-iptables]

enabled  = true
filter   = vsftpd
action   = iptables[name=VSFTPD, port=ftp, protocol=tcp]
           sendmail-whois[name=VSFTPD, dest=[e-mail]]
logpath  = /var/log/secure
maxretry = 4
bantime  = 259200

/etc/fail2ban/filter.d/vsftpd.conf:

# Fail2Ban filter for vsftp
#

[INCLUDES]

before = common.conf

[Definition]

__pam_re=\(?pam_unix(?:\(\S+\))?\)?:?
_daemon =  vsftpd

failregex = ^%(__prefix_line)s%(__pam_re)s\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=(ftp)? ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
            ^ \[pid \d+\] \[.+\] FAIL LOGIN: Client "<HOST>"\s*$

ignoreregex = 

# Author: Cyril Jaquier

Answer 1

[yorm]

Несмотря на количество ответов, вроде, разобрался.
Проблема исключительно в том, что fail2ban хочет видеть IP, а vsftpd ресолвит их в днс-имена.
Здесь: www.fail2ban.org/wiki/index.php/FAQ_english внизу есть совет:

Scenario: VSFTP configuration is set for PAM authentication, using xferlog in standard format. Fail2ban for vsftpd is watching /var/log/secure
Problem: PAM sends failed login information to /var/log/secure, but the remote server's IP address has been replaced by a DNS name. Resulting DNS name does not resolve or does not resolve correctly, thus fail2ban is unable to ban the IP address.
Fix: Configure VSFTP for "dual_log_enable=YES", and have fail2ban watch /var/log/vsftpd.log instead. This log file shows the incoming ip address instead of the DNS name.

Соответственно, дописал
dual_log_enable=YES
в /etc/vsftpd/vsftpd.conf. Рестартнул сервис, проверил, что появился новый лог. Изменил в /etc/fail2ban/jail.conf настройку местоположения лога на
/var/log/vsftpd.log
и рестартнул второй сервис.