This directory contains files and information related to the fail2ban setup on the host

Actions

The file secinfo-xmpp.conf should be placed in /etc/fail2ban/actions.d

It invokes /usr/local/lib/secinfo-xmpp/secinfo-client to send the ban information to the XMPP group. 

Rules

In rules where you wish to share the information that a service has been banned you should create a file in /etc/rules.d/someservice.local similar to the example sshd.local.

[sshd]

enabled = true

action = %(known/action)s
         secinfo-xmpp

This will invoke to secinfo-xmpp action after your normal default action


sshd-invalidroot
----------------

This is a example filter and jail entry for more agressive banning on systems with no legitimate root logins. It picks out root login attempts specifically, and bans them on first attempt for 1 week.


