<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>If I remember right, it creates the fail2ban chain, and when an ssh connection comes in, it references that chain to see if the IP is in the list, if it is, it drops it, otherwise it lets it go. I use it on my webserver, since it's a frequent target of brute force authentication attempts.</div><br><div><div>On Jan 16, 2009, at 5:19 PM, Paul Cartwright wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>On Fri January 16 2009, Ken Ratliff wrote:<br><blockquote type="cite">*filter<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">:fail2ban-ssh - [0:0]<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">-A INPUT -p tcp -m tcp --dport 22 -j fail2ban-ssh<br></blockquote><blockquote type="cite">-A fail2ban-ssh -j RETURN<br></blockquote><br>I looked up fail2ban, looks like it isn't ready for stable yet.. <br>yet aptitude install fail2ban worked.. I use ssh, what exactly does those <br>lines do for you??<br><br>-- <br>Paul Cartwright<br>Registered Linux user # 367800<br>Registered Ubuntu User #12459<br>_______________________________________________<br>Ale mailing list<br><a href="mailto:Ale@ale.org">Ale@ale.org</a><br><a href="http://mail.ale.org/mailman/listinfo/ale">http://mail.ale.org/mailman/listinfo/ale</a><br></div></blockquote></div><br></body></html>