<br><br><div class="gmail_quote">On Mon, Oct 24, 2011 at 10:14 AM, Mike Wohlgemuth <span dir="ltr"><<a href="mailto:mjw@woogie.net">mjw@woogie.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
I've installed fail2ban on Fedora 15 to block repeated failed ssh<br>
connections. It works great up until logrotate kicks in. When it<br>
rotates /var/log/secure then fail2ban stops noticing failed ssh<br>
attempts. Using fail2ban-client to reload the jail fixes the problem,<br>
but it also causes fail2ban to forget all currently banned IP<br>
addresses. I've found scripts online that will allow for extracting the<br>
current bans before reloading, and then applying them again after, but<br>
that seems pretty extreme. I can't help but think I must be missing<br>
something simple that will get fail2ban to notice that the logs have<br>
been rotated. Has anyone else seeing this issue? I see some reports in<br>
bugzilla about fail2ban, but nothing that is definitely this problem.<br>
<br>
Thanks<br>
Mike<br>
<font color="#888888">--</font><br></blockquote></div><br><br>Hi<br><br>This does not address your problem directly. <br><br>I use a program called denyhosts for blocking ssh attempts. It creates a list in /etc/hosts.deny.<br>
<br>Great program.<br><br>Good luck<br><br>Marvin<br><br>