So, I installed (and configured) fail2ban on three Ubuntu VPS servers. I configured (imo) a maximum of 3 failed login attempts (via Putty as root) within 2 minutes. Then I restarted the fail2ban service (according to this manual).
But when I look at my
auth.log files in
/var/log/ I still see 4, 5 or more failed attempts from certain IP's. So obviously I did something wrong as the IP is not blocked after 3 failed attempts.
It might have to do something with
iptables, but that's where it gets a bit "foggy" for me..
Not sure how to setup a
Additional: I see that the login attempts mostly have different ports for every attempt. Does that influence the count to
Because I see a port being "poked" twice and then no more attempts. Then the IP tries a different port (again 2 times). (all bots of course)