我在Ubuntu服务器上使用directadmin。 我最近安装了Fail2Ban。 但我仍然收到来自directadmin的“暴力攻击”电子邮件。 我的jail.conf（只有auth.log jails！）：
[ssh] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log maxretry = 6 [pam-generic] enabled = false filter = pam-generic port = all banaction = iptables-allports port = anyport logpath = /var/log/auth.log maxretry = 6 [ssh-ddos] enabled = false port = ssh filter = sshd-ddos logpath = /var/log/auth.log maxretry = 6 我的auth.log（部分）：
Mar 12 05:31:29 server sshd[24203]: Invalid user justin from 59.148.193.108 Mar 12 05:31:29 server sshd[24203]: input_userauth_request: invalid user justin [preauth] Mar 12 05:31:29 server sshd[24203]: pam_unix(sshd:auth): check pass; user unknown Mar 12 05:31:29 server sshd[24203]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=059148193108.ctinets.com Mar 12 05:31:31 server sshd[24203]: Failed password for invalid user justin from 59.148.193.108 port 36573 ssh2 Mar 12 05:31:31 server sshd[24203]: Received disconnect from 59.148.193.108: 11: Bye Bye [preauth] Mar 12 07:38:29 server sshd[30093]: reverse mapping checking getaddrinfo for 221.51.174.61.dial.wz.zj.dynamic.163data.com.cn [61.174.51.221] failed - POSSIBLE BREAK-IN ATTEMPT! Mar 12 07:38:30 server sshd[30093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.174.51.221 user=admin Mar 12 07:38:32 server sshd[30093]: Failed password for admin from 61.174.51.221 port 4413 ssh2 Mar 12 07:38:44 server sshd[30093]: message repeated 5 times: [ Failed password for admin from 61.174.51.221 port 4413 ssh2] Mar 12 07:38:44 server sshd[30093]: Disconnecting: Too many authentication failures for admin [preauth] Mar 12 07:38:44 server sshd[30093]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.174.51.221 user=admin Mar 12 07:38:44 server sshd[30093]: PAM service(sshd) ignoring max retries; 6 > 3
我已经在某个地方看过，它可能与date格式有关。 但经过调查，他们已经修复了更新版本的fail2ban。