3 ms·
On my very insignificant server, fail2ban has banned around 400 IP addresses in 2016, so far. What actionable information would I have received by having a disr
by dhoe 11y ago
On my very insignificant server, fail2ban has banned around 400 IP addresses in 2016, so far. What actionable information would I have received by having a disruptive notification about it?
- sschueller 11y agoI agree, what I do instead is track the number of currently banned with nagios and if it goes over a specific threshold I get a warning. With PNP4Nagios you also get a nice graph over time.
- danieltillett 11y agoNone. It is the attacks that don't get banned that you want to know about. On this topic does anyone know if there is something simple that will tell you if a new IP address logs in or a new process is started?
- notfoss 11y agoFor new IP addresses, you can write a script to monitor your auth.log file.
- herbst 11y agoI have them in a quiet channel without notifications just to amuse myself. I have not nearly that much tho