> You need to show us some logs from samba that include a failed auth
> attempt. You have lot of them, when you're seeing brute-force attempts ;)

Hello Tom, thanks for your reply :)

every PC that try to connect with wrong credentails make on samba server 
a log like this:

[2016/10/15 14:14:38.371368,  2] 
../source3/auth/auth.c:315(auth_check_ntlm_password)
   check_ntlm_password:  Authentication for user [admin] -> [admin] 
FAILED with error NT_STATUS_WRONG_PASSWORD

fail2ban should be check not only a log file but all files:

192.168.34.1.log
192.168.34.2.log
192.168.34.3.log
192.168.34.4.log
[...]

every log file match with a PC

thanks for help

Pol

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most 
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
Fail2ban-users mailing list
Fail2ban-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fail2ban-users

Reply via email to