[ssh-iptables]
enabled = true
filter = sshd
findtime = 600
action = iptables[name=SSH, port=ssh, protocol=tcp]
logpath = /var/log/auth.log
maxretry = 3
iptables -v -nL
Chain INPUT (policy ACCEPT 199 packets, 21709 bytes)
pkts bytes target prot opt in out source destination
199 21709 fail2ban-ASTERISK all -- * * 0.0.0.0/0 0.0.0.0/0
153 14503 fail2ban-SSH tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:10022
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 160 packets, 26015 bytes)
pkts bytes target prot opt in out source destination
Chain fail2ban-ASTERISK (1 references)
pkts bytes target prot opt in out source destination
199 21709 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain fail2ban-SSH (1 references)
pkts bytes target prot opt in out source destination
153 14503 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
tail /var/log/fail2ban.log
2013-01-24 18:32:52,807 fail2ban.filter : DEBUG /var/log/auth.log has been modified
2013-01-24 18:32:52,807 fail2ban.filter.datedetector: DEBUG Sorting the template list
2013-01-24 19:17:01,459 fail2ban.filter : DEBUG /var/log/auth.log has been modified
2013-01-24 19:17:01,459 fail2ban.filter.datedetector: DEBUG Sorting the template list
2013-01-24 20:11:49,815 fail2ban.filter : DEBUG /var/log/auth.log has been modified
2013-01-24 20:11:49,816 fail2ban.filter.datedetector: DEBUG Sorting the template list
2013-01-24 20:11:59,826 fail2ban.filter : DEBUG /var/log/auth.log has been modified
2013-01-24 20:11:59,826 fail2ban.filter.datedetector: DEBUG Sorting the template list
2013-01-24 20:12:04,831 fail2ban.filter : DEBUG /var/log/auth.log has been modified
2013-01-24 20:12:04,831 fail2ban.filter.datedetector: DEBUG Sorting the template list
Файлы превышающие размер не удаляют, но ничего другого записать нельзя