Scanning through my log files, I see repeated unauthorized attempts to log in to my FTP server. The system uses rDNS to give me a hostname of the remote user, and if rDNS gives an answer — even a hostname in a non-existent TLD! — then it does not log the numeric IP address. I am trying to set up
fail2ban to jail the IP, but I can't jail (for example)
hn.kd.ny.adsl because it doesn't exist. (Also, there is the obvious possibility of mischief if someone points their rDNS to some unrelated FQDN hostname that does exist.) Ideally, I'd like to log both the IP and the name, but if I have to choose, I must have the raw IP.
I'm on CentOS 6 (in the process of upgrading to CentOS 7). Here is my
vsftpd.conf, omitting comments:
anonymous_enable=NO local_enable=YES write_enable=YES local_umask=022 dirmessage_enable=YES xferlog_enable=YES connect_from_port_20=YES xferlog_std_format=YES chroot_local_user=YES listen=YES pam_service_name=vsftpd userlist_enable=YES tcp_wrappers=YES