2015-10-27
Dear fail2ban, valid ssh logins with broken reverse DNS are 'normal'
I got locked out of my own server due to fail2ban triggering on:sshd[12449]: Address aaa.bbb.ccc.ddd maps to something.example.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! sshd[12723]: Address aaa.bbb.ccc.ddd maps to something.example.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! sshd[12916]: Address aaa.bbb.ccc.ddd maps to something.example.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!That was just a few scp actions in short succession, and no reason to lock me out! I updated /etc/fail2ban/filter.d/sshd.conf and removed this from the failregex:^%(__prefix_line)sAddress.* POSSIBLE BREAK-IN ATTEMPT!*\s*$