Now fix the jail. The brute force is still on the lab-sshd service, while the jail reads the empty sshd.service. Aim it at the right service's journal, reload the rules with fail2ban-client reload and wait: once the refusals pass the threshold, the attacker's address will be banned.
Aim the jail at the right journal
fail2ban is running, but the sshd jail reads the sshd.service journal, while the brute force is on the lab-sshd service. Aim the jail at the lab-sshd journal, reload the fail2ban rules and wait for the address 192.0.2.20 to be banned.
Goals · 0 of 2
- Aim the jail at the attacked service's journal not done yet
- Wait for the attacker's address to be banned not done yet