relkci / f2bdistro Goto Github PK

Installing under Debian Stretch the regex was not working properly because the PORT was not just numeric digits in the logs. They included ranges 0:65535 and port names like ssh and http,https

I changed it to .* instead of \d to get around this problem and allowed all my other ban actions to propagate to other machines properly.

Hello. I read your article and applied the concept to my own servers using plain ssh connecttions (ssh execute on the remote host) instead of sshfs. It works well.

However it would be nice if the hosts tracked UNBAN actions too. Right now if you manually unban an IP before the expiry time you have to go to all the hosts and do it there too. Perhaps it would be best applied as a hook to the client commands rather than watching the fail2ban log. I will post details if I get a chance to implement this myself.