Scanning through my log files, I see repeated unauthorized attempts to log in to my FTP server. The system uses rDNS to give me a hostname of the remote user, and if rDNS gives an answer — even a hostname in a non-existent TLD! — then it does not log the numeric IP address. I am trying to set up fail2ban to jail the IP, but I can't jail (for example) hn.kd.ny.adsl because it doesn't exist. (Also, there is the obvious possibility of mischief if someone points their rDNS to some unrelated FQDN hostname that does exist.) Ideally, I'd like to log both the IP and the name, but if I have to choose, I must have the raw IP.

I'm on CentOS 6 (in the process of upgrading to CentOS 7). Here is my vsftpd.conf, omitting comments:


This is annoying, and I could not find a simple solution. I think the xferlog format is for backward compatibility with wu_ftp.

According to fail2ban wiki, this is what you need to do:

Configure VSFTP for "dual_log_enable=YES", and have fail2ban watch /var/log/vsftpd.log instead. This log file shows the incoming ip address instead of the DNS name.

What leaves me annoyed still though is the latency of looking up the reverse pointer, which relies on DNS lookup timeout. If transferring several thousand files and you have no reverse pointer, or no DNS server set for the in-addr block, will each transfer wait for DNS timeout?

| improve this answer | |
  • Thanks! The dual_log_enable writes to vsftpd.log, which gives me log entries like this: Mon Mar 13 19:25:41 [pid 1] [Polycom] FAIL LOGIN: Client "141.xxx.xxx.xxx" which fail2ban can quite happily use to jail the miscreants. – Linc Madison Mar 17 '17 at 0:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.