On Mon, 9 Mar 2015, John Plemons wrote: > Been working on fail2ban, and trying to make it work with plain Jane > install of Centos 7 > > Current available epel repo version is fail2ban-0.9.1 > > Looking at the log file, fail2ban starts and stops fine, there isn't output > though showing any login attempts being restricted. Here's the setup I use on CentOS 7 machines: Packages: * fail2ban-firewalld-0.9.1-2.el7.noarch * fail2ban-server-0.9.1-2.el7.noarch * ipset-6.19-4.el7.x86_64 * rsyslog-7.4.7-7.el7_0.x86_64 Basics of jail.local: ----- %< ----- # /etc/fail2ban/jail.local [DEFAULT] banaction = firewallcmd-ipset [sshd] enabled = true maxretry = 2 [sshd-ddos] enabled = true maxretry = 2 ----- %< ----- Once it's up and running, "sudo ipset list" will give you the status of IP addresses associated with each ban rule. -- Paul Heinlein heinlein at madboa.com 45°38' N, 122°6' W