On Mon, 9 Mar 2015, John Plemons wrote:
Been working on fail2ban, and trying to make it work with plain Jane install of Centos 7
Current available epel repo version is fail2ban-0.9.1
Looking at the log file, fail2ban starts and stops fine, there isn't output though showing any login attempts being restricted.
Here's the setup I use on CentOS 7 machines:
Packages: * fail2ban-firewalld-0.9.1-2.el7.noarch * fail2ban-server-0.9.1-2.el7.noarch * ipset-6.19-4.el7.x86_64 * rsyslog-7.4.7-7.el7_0.x86_64
Basics of jail.local:
----- %< ----- # /etc/fail2ban/jail.local [DEFAULT] banaction = firewallcmd-ipset
[sshd] enabled = true maxretry = 2
[sshd-ddos] enabled = true maxretry = 2 ----- %< -----
Once it's up and running, "sudo ipset list" will give you the status of IP addresses associated with each ban rule.