fail2ban blockt nur ssh

Hey,
obwohl in der less /etc/fail2ban/jail.local folgendes steht.
Code:
[dovecot-pop3imap]
enabled = true
filter = dovecot-pop3imap
action = iptables-multiport[name=dovecot-pop3imap, port="pop3,pop3s,imap,imaps", protocol=tcp]
logpath = /var/log/mail.log
maxretry = 20
findtime = 1200
bantime = 1200

[pureftpd]
enabled = true
port = ftp
filter = pureftpd
logpath = /var/log/syslog
maxretry = 3

[postfix-sasl]
enabled = true
port = smtp
filter = postfix-sasl
logpath = /var/log/mail.log
maxretry = 5

finder ich in der tail -f /var/log/fail2ban.log ausschließlich Einträge vom sshd.

In der tail -f /var/log/mail kommen im Sekundentakt Meldungen wie diese:
Code:
warning: unknown[87.246.7.34]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
 disconnect from unknown[87.246.7.34] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
 warning: hostname net6-ip34.linkbg.com does not resolve to address 87.246.7.34: Name or service not known

Woran kann das liegen?

Vielen Dank und viele Grüße
Ronny
 

Werbung

Top