Problem with Fail2ban and “sendmail-whois-lines.conf”
by DSH_NH from LinuxQuestions.org on (#58XGZ)
I am running fail2ban to limit brute force SSH and FTP attacks. When an IP is banned, I receive an email with the who is" information of the banned IP along with the log entries detailing the attack. The file I used to configure what information is included in that email is sendmail-whois-lines.conf".
Recently I noted that for repeat offenders, there were many lines of log entries covering multiple attacks. In an effort to reduce the number of lines included in the email, I modified the sendmail-whois-lines.conf" file to limit the number of included lines to 12. Unfortunately, that modification only modifies how fail2ban uses grep with the -m" switch so that although I now only receive 12 lines of log entries, they are the first 12 lines in the log file for that IP. The result is that the log entries in the email can sometimes document a past attack and not the current attack. I have reviewed the man pages for grep but there does not seem to be a similar switch to limit the result to the last X" number of occurrences like there is for the first X" occurrences.
Is there a way of altering this behavior from within fail2ban that I have missed?
Recently I noted that for repeat offenders, there were many lines of log entries covering multiple attacks. In an effort to reduce the number of lines included in the email, I modified the sendmail-whois-lines.conf" file to limit the number of included lines to 12. Unfortunately, that modification only modifies how fail2ban uses grep with the -m" switch so that although I now only receive 12 lines of log entries, they are the first 12 lines in the log file for that IP. The result is that the log entries in the email can sometimes document a past attack and not the current attack. I have reviewed the man pages for grep but there does not seem to be a similar switch to limit the result to the last X" number of occurrences like there is for the first X" occurrences.
Is there a way of altering this behavior from within fail2ban that I have missed?