Fail2ban

bans IPs that cause multiple authentication errors

Monitors log files (e.g. /var/log/auth.log, /var/log/apache/access.log) and temporarily or persistently bans failure-prone addresses by updating existing firewall rules. The software was completely rewritten at version 0.7.0 and now allows easy specification of different actions to be taken such as to ban an IP using iptables or hostsdeny rules, or simply to send a notification email. Currently, by default, supports ssh/apache/vsftpd but configuration can be easily extended for monitoring any other ASCII file. All filters and actions are given in the config files, thus fail2ban can be adopted to be used with a variety of files and firewalls.

Homepage: Fail2ban

Pure-Ftpd/Shorewall

syslog

 Jan 27 09:32:58 hostname pure-ftpd: (?@81.169.128.26) [WARNING] Sorry, cleartext sessions are not accepted on this server. Please reconnect using SSL/TLS security mechanisms.

/etc/fail2ban/filter.d/pureftpd.conf

# Fail2Ban configuration file
#
# Author: JT
#
# $Revision: 2 $
#

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching.
# Values: TEXT
#
#Jan 27 09:32:58 hostname pure-ftpd: (?@81.169.128.26) [WARNING] Sorry, cleartext sessions are not accepted on this server. Please reconnect using SSL/TLS security mechanisms.
#
failregex = pure-ftpd: \(.*@<HOST>\) \[WARNING\] Sorry, cleartext sessions are not accepted.*

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

/etc/fail2ban/jail.local

[DEFAULT]
banaction = shorewall
action = %(action_mwl)s

[ssh]
enabled = true
maxretry = 6

[pam-generic]
enabled = true
maxretry = 6

[sasl]
enabled  = true
port     = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
filter   = sasl
# You might consider monitoring /var/log/mail.warn instead if you are
# running postfix since it would provide the same log lines at the
# "warn" level but overall at the smaller filesize.
logpath  = /var/log/mail.log

[pureftpd]
enabled  = true
port     = ftp,ftp-data,ftps,ftps-data
filter   = pureftpd
logpath  = /var/log/syslog
maxretry = 6

[postfix]
enabled  = true
port     = smtp,ssmtp
filter   = postfix
logpath  = /var/log/mail.log

[dovecot]
enabled = true
port    = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
filter  = dovecot
logpath = /var/log/mail.log