) и сделал читабельней текст 
Код: Выделить всё
2010-12-08 20:17:52,594 fail2ban.actions: WARNING [exim-ipfw] Ban 116.111.153.131
2010-12-08 20:18:05,956 fail2ban.actions: WARNING [exim-ipfw] Ban 123.18.185.202
2010-12-08 20:18:10,078 fail2ban.actions: WARNING [exim-ipfw] Ban 123.18.240.231
2010-12-08 20:18:33,737 fail2ban.actions: WARNING [exim-ipfw] Ban 94.189.237.243
2010-12-08 20:19:40,630 fail2ban.actions: WARNING [exim-ipfw] Ban 118.71.28.162
2010-12-08 20:19:49,895 fail2ban.actions: WARNING [exim-ipfw] 123.18.185.202 already banned
2010-12-08 20:21:21,480 fail2ban.actions: WARNING [exim-ipfw] Ban 118.68.110.201
2010-12-08 20:22:27,343 fail2ban.actions: WARNING [exim-ipfw] 123.18.185.202 already banned
2010-12-08 20:22:36,602 fail2ban.actions: WARNING [exim-ipfw] Ban 180.242.62.71
2010-12-08 20:25:21,246 fail2ban.actions: WARNING [exim-ipfw] Ban 187.24.149.37
Код: Выделить всё
[b]ipfw table 50 list[/b]
94.189.237.243/32 0
116.111.153.131/32 0
118.68.110.201/32 0
118.71.28.162/32 0
123.18.185.202/32 0
123.18.240.231/32 0
180.242.62.71/32 0
187.24.149.37/32 0
Код: Выделить всё
01400 92 17744 deny tcp from table(50) to me dst-port 25 via bce1Код: Выделить всё
2012-02-04 12:55:30,236 fail2ban.actions: WARNING [apache_jail-ipfw] Ban 136.169.199.40
2012-02-04 12:57:59,489 fail2ban.actions: WARNING [apache_jail-ipfw] 136.169.199.40 already banned
2012-02-04 12:58:51,550 fail2ban.actions: WARNING [apache_jail-ipfw] 136.169.199.40 already banned
2012-02-04 12:59:23,596 fail2ban.actions: WARNING [apache_jail-ipfw] 136.169.199.40 already banned
2012-02-04 13:02:24,058 fail2ban.actions: WARNING [apache_jail-ipfw] 136.169.199.40 already banned
2012-02-04 20:55:30,534 fail2ban.actions: WARNING [apache_jail-ipfw] Unban 136.169.199.40Так как результатом работы Fail2ban будет правило для занесения адреса в правило блокировки firewall, тоnezabor писал(а):А вот у мну вопрос например например забанил я хорошего человека(руки у него кривые, но без злого умысла), за неправильный набор имени и как теперь убрать его из бана в ручную может есть у кого предлдожение
на всяк случай Ubuntu 12.* и для FreeBSD
Код: Выделить всё
[exim]
2
3 #port = smtp,465,submission
4 #logpath = /var/log/exim/mainlog
5
6 enabled = true
7 filter = exim
8 action = exim-ipfw[table=50]
9 #sendmail[name=exim-spam-dnsbl, dest=admin@domenchik.ru sender=fail2ban@domenchik.ru]
10 logpath = /var/log/exim/domenchik.ru/exim_reject-20140625
11 maxretry = 2
12 bantime = 18000
Код: Выделить всё
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# exim-common.local
before = exim-common.conf
[Definition]
failregex = authenticator failed for (\S+ )?\(\S+\) \[<HOST>\] (I=\[\S+\]:\d+): 535 Incorrect authentication data
ignoreregex =.
Код: Выделить всё
[Definition]
actionstart =
actionstop =
actioncheck =
actionban = /sbin/ipfw table <table> add <ip>
actionunban = /sbin/ipfw table <table> delete <ip>
[Init]
localhost = 127.0.0.1
Код: Выделить всё
fail2ban-regex /var/log/exim/domenchik.ru/exim_reject-20140625 /usr/local/etc/fail2ban/filter.d/exim.conf
Running tests
=============
Use failregex file : /usr/local/etc/fail2ban/filter.d/exim.conf
Use single line : /var/log/exim/domenchik.ru/exim_reject-20140625
Results
=======
Failregex: 0 total
Ignoreregex: 0 total
Date template hits:
Lines: 1 lines, 0 ignored, 0 matched, 1 missed
|- Missed line(s):
| /var/log/exim/domenchik.ru/exim_reject-20140625
`-
Код: Выделить всё
exim_ban_table="table(50)"
${ipfw} -f flush
${ipfw} add 10 deny tcp from ${exim_ban_table} to me 25
Код: Выделить всё
2014-06-25 00:57:43 auth_login authenticator failed for (User) [50.57.186.49] I=[91.185.48.163]:25: 535 Incorrect authentication data (set_id=admin)
2014-06-25 00:57:43 auth_login authenticator failed for (User) [50.57.186.49] I=[91.185.48.163]:25: 535 Incorrect authentication data (set_id=admin)Код: Выделить всё
2014-06-25 00:57:43,747 fail2ban.server.filterpoll[66537]: DEBUG /var/log/maillog has been modified
2014-06-25 00:57:43,747 fail2ban.server.datedetector[66537]: DEBUG Matched time template (?:DAY )?MON Day 24hour:Minute:Second(?:\.Microseconds)?(?: Year)?
2014-06-25 00:57:43,748 fail2ban.server.datedetector[66537]: DEBUG Got time 1403625463.000000 for "u'Jun 25 00:57:43'" using template (?:DAY )?MON Day 24hour:Minute:Second(?:\.Microseconds)?(?: Year)?
2014-06-25 00:57:43,748 fail2ban.server.filter[66537]: DEBUG Processing line with time:1403625463.0 and ip:50.57.186.49
Код: Выделить всё
pkg info py27-fail2ban
py27-fail2ban-0.9.0_2
Name : py27-fail2ban
Version : 0.9.0_2
Installed on : Sun Jun 22 03:30:11 IRKT 2014
Origin : security/py-fail2ban
Architecture : freebsd:10:x86:64
Prefix : /usr/local
Categories : security python
Licenses : GPLv2
Maintainer : theis@gmx.at
WWW : http://www.fail2ban.org/wiki/index.php/Main_Page
Comment : Scans log files and bans IP that makes too many password failures
Flat size : 737KiB
Description :
Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/error_log
and bans IP that makes too many password failures. It updates firewall rules
to reject the IP address.
uname -a
FreeBSD 10.0-RELEASE FreeBSD 10.0-RELEASE #0 r260789: Thu Jan 16 22:34:59 UTC 2014
Код: Выделить всё
[client 114.55.62.121:26957] AH01630: client denied by server configuration: /WWW/мойсайт/db_session.init.php
Код: Выделить всё
[exim]
enabled = true
port = smtp,465,submission
logpath = /var/log/exim/exim_main.log
action = bsd-ipfw[table=20]
%(action_mwl)s