Hello Mark, On Mon, 2012-08-13 at 11:30 -0400, m.roth at 5-cent.us wrote: > Aug 10 17:44:56 <my server> sshd[12350]: Connection from 114.113.199.142 > port 511 > 871 > Aug 10 17:44:57 <my server> sshd[12341]: Received disconnect from > 114.113.199.144 > 2: 11: Bye Bye I'm confused, what exactly is the problem? Fail2ban only triggers on "Failed password from" entries (assuming you use the default filter, and I don't suppose you want it to trigger on disconnects because that would ban legitimate hosts that connect frequently). The above looks like someone connecting then disconnecting without even attempting a login. Regards, Leonard. -- mount -t life -o ro /dev/dna /genetic/research