<HTML><HEAD></HEAD>
<BODY>
<DIV dir=ltr id=idOWAReplyText33975>
<DIV dir=ltr><FONT color=#000000 size=2 face=Arial>Your delay is due to the amount of time the F2B script takes to read the log file, and due to how often it is called. I do not believe it is a realtime event. Say, every minute it's called to read the log and act. I'm not sure of the exact numbers, but you get the idea....</FONT></DIV>
<DIV dir=ltr> </DIV></DIV>
<DIV dir=ltr><BR>
<HR tabIndex=-1>
<FONT size=2 face=Tahoma><B>From:</B> vip killa<BR><B>Sent:</B> Thu 3/31/2011 8:17 AM<BR><B>To:</B> Asterisk Users Mailing List - Non-Commercial Discussion<BR><B>Subject:</B> Re: [asterisk-users] asterisk and fail2ban<BR></FONT><BR></DIV>
<DIV>Back to the original question, for those of you using Fail2Ban,
<DIV>Does it take an unusually high amount of break-in attempts before attackers are banned?</DIV>
<DIV>I have it set to 5 attempts in fail2ban but usually, the attacker is able to make over 100 attempts before fail2ban bans them.</DIV>
<DIV>I've tried this using asterisk's /var/log/asterisk/messages and /var/log/messages with same results.</DIV>
<DIV><SPAN style="BORDER-COLLAPSE: collapse; FONT-FAMILY: arial, sans-serif; FONT-SIZE: 13px" class=Apple-style-span>Perhaps someone else is experiencing this or has resolved it, thank you.</SPAN></DIV>
<DIV><SPAN style="BORDER-COLLAPSE: collapse; FONT-FAMILY: arial, sans-serif; FONT-SIZE: 13px" class=Apple-style-span>
<DIV><BR></DIV></SPAN><BR>
<DIV class=gmail_quote>On Thu, Mar 31, 2011 at 4:05 AM, Gordon Henderson <SPAN dir=ltr><<A href="mailto:gordon%2Basterisk@drogon.net" target=_blank>mailto:gordon%2Basterisk@drogon.net</A>></SPAN> wrote:<BR>
<BLOCKQUOTE style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class=gmail_quote>
<DIV class=im>On Wed, 30 Mar 2011, Terry Brummell wrote:<BR><BR></DIV>
<DIV class=im>
<BLOCKQUOTE style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class=gmail_quote>Yah, sounds simple, how do you set it up to do this? Fail2Ban was<BR>pretty easy, if it's that easy, why was F2B even created?<BR></BLOCKQUOTE><BR></DIV>It's easy for me because I read an undestand how things work, and deal with Linux firewalling in a daily basis. Fail2ban is an (almost) drop-in solution which requires minimal thinking - just a few lines in a config file to edit. (and python which I don't have installed on my systems)
<DIV>
<DIV></DIV>
<DIV class=h5><BR><BR>Gordon<BR><BR>--<BR>_____________________________________________________________________<BR>-- Bandwidth and Colocation Provided by <A href="http://www.api-digital.com/" target=_blank>http://www.api-digital.com/</A> --<BR>New to Asterisk? Join us for a live introductory webinar every Thurs:<BR> <A href="http://www.asterisk.org/hello" target=_blank>http://www.asterisk.org/hello</A><BR><BR>asterisk-users mailing list<BR>To UNSUBSCRIBE or update options visit:<BR> <A href="http://lists.digium.com/mailman/listinfo/asterisk-users" target=_blank>http://lists.digium.com/mailman/listinfo/asterisk-users</A><BR></DIV></DIV></BLOCKQUOTE></DIV><BR></DIV></DIV></BODY></HTML>