On 2022-03-14 10:48, Harold Hallikainen via Fail2ban-users wrote: > Sorry if this is an old question or one with an obvious solution. I have > been using fail2ban for quite a while and really like it! But, in > reviewing logs, I see hundreds of ssh login attempts each day where there > is only one attempt per IP address. I suspect this is a bot net and would > like to ban them. Is there a command line method of telling to fail2ban to > ban ALL failures (not just multiple) in the past day (or other preiod)?
Fail2ban can't protect from such botnets. https://bsdly.blogspot.com/2013/10/the-hail-mary-cloud-and-lessons-learned.html _______________________________________________ Fail2ban-users mailing list Fail2ban-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/fail2ban-users
