Plesk 12.5 fail2ban not banning IPs

[ethanielc]

This is my SSH jail config from Plesk fail2ban UI

[ssh]
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
logpath = /var/log/secure
maxretry = 5

From /var/log/secure i still seeing an IP brute forcing SSH service on random ports.

>Failed password for root from xx.xx.xx.xx port 39132 ssh2
>Failed password for root from xx.xx.xx.xx port 37461 ssh2
...

any idea? thanks!

 

[IgorG]

You jail catches only 22 ssh port but there are different ports - 39132, 37461. Therefore use iptables-allports action. Also you can try to write own regexp for these messages in Filter with help of fail2ban documentation - http://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Filters