On Sun, Nov 10, 2019 at 06:08:52AM -0500, Gene Heskett wrote: [...] > But, I'm getting the impression that it has to fail before fail2ban kicks > in [...] No. It has to "succeed" once before fail2ban can do its job. It is: - assess client behaviour - http server writes a log entry (or a set thereof) which fail2ban can feed on - magic (i.e. fail2ban rules) - fail2ban blocks offending address. It's the same process you're doing manually now. If you can codify the decisions you take in the form of fail2ban rules, then fail2ban is for you. Cheers -- t
Attachment:
signature.asc
Description: Digital signature