我在 Ubuntu 服务器上使用 directadmin。我最近安装了 Fail2Ban。但我仍然收到来自 directadmin 的“暴力攻击”电子邮件。我的 jail.conf（只有 auth.log jails！）：
[ssh]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 6
[pam-generic]
enabled = false
filter = pam-generic
port = all
banaction = iptables-allports
port = anyport
logpath = /var/log/auth.log
maxretry = 6
[ssh-ddos]
enabled = false
port = ssh
filter = sshd-ddos
logpath = /var/log/auth.log
maxretry = 6
我的 auth.log (部分):
Mar 12 05:31:29 server sshd[24203]: Invalid user justin from 59.148.193.108
Mar 12 05:31:29 server sshd[24203]: input_userauth_request: invalid user justin [preauth]
Mar 12 05:31:29 server sshd[24203]: pam_unix(sshd:auth): check pass; user unknown
Mar 12 05:31:29 server sshd[24203]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=059148193108.ctinets.com
Mar 12 05:31:31 server sshd[24203]: Failed password for invalid user justin from 59.148.193.108 port 36573 ssh2
Mar 12 05:31:31 server sshd[24203]: Received disconnect from 59.148.193.108: 11: Bye Bye [preauth]
Mar 12 07:38:29 server sshd[30093]: reverse mapping checking getaddrinfo for 221.51.174.61.dial.wz.zj.dynamic.163data.com.cn [61.174.51.221] failed - POSSIBLE BREAK-IN ATTEMPT!
Mar 12 07:38:30 server sshd[30093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.174.51.221 user=admin
Mar 12 07:38:32 server sshd[30093]: Failed password for admin from 61.174.51.221 port 4413 ssh2
Mar 12 07:38:44 server sshd[30093]: message repeated 5 times: [ Failed password for admin from 61.174.51.221 port 4413 ssh2]
Mar 12 07:38:44 server sshd[30093]: Disconnecting: Too many authentication failures for admin [preauth]
Mar 12 07:38:44 server sshd[30093]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.174.51.221 user=admin
Mar 12 07:38:44 server sshd[30093]: PAM service(sshd) ignoring max retries; 6 > 3
我读到过一些文章说这可能与日期格式有关。但经过调查后，他们已经在较新版本的 fail2ban 中修复了这个问题。