Настройка fail2ban для vsftpd

May 25 00:48:18 localhost fail2ban.filter : WARNING Unable to find a corresponding IP address for cable-181-133-26-174.une.net.co: [Errno -2] Name or service not known
May 25 00:48:18 localhost fail2ban.filter : WARNING Unable to find a corresponding IP address for cable-181-133-26-174.une.net.co: [Errno -2] Name or service not known
May 25 00:48:18 localhost fail2ban.filter : WARNING Unable to find a corresponding IP address for cable-181-133-26-174.une.net.co: [Errno -2] Name or service not known
May 25 00:48:18 localhost fail2ban.filter : WARNING Unable to find a corresponding IP address for cable-181-133-26-174.une.net.co: [Errno -2] Name or service not known
May 25 00:48:18 localhost fail2ban.filter : WARNING Unable to find a corresponding IP address for cable-181-133-26-174.une.net.co: [Errno -2] Name or service not known

May 25 00:48:02 localhost vsftpd[20600]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=test123 rhost=201-211-198-200.genericrev.cantv.net 
May 25 00:48:02 localhost vsftpd[20600]: pam_succeed_if(vsftpd:auth): error retrieving information about user test123
May 25 00:48:07 localhost vsftpd[20602]: pam_unix(vsftpd:auth): check pass; user unknown
May 25 00:48:07 localhost vsftpd[20602]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=test123 rhost=201-211-198-200.genericrev.cantv.net 
May 25 00:48:07 localhost vsftpd[20602]: pam_succeed_if(vsftpd:auth): error retrieving information about user test123
May 25 00:48:37 localhost vsftpd[20604]: pam_unix(vsftpd:auth): check pass; user unknown
May 25 00:48:37 localhost vsftpd[20604]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=test123 rhost=201-211-198-200.genericrev.cantv.net 
May 25 00:48:37 localhost vsftpd[20604]: pam_succeed_if(vsftpd:auth): error retrieving information about user test123
May 25 00:48:42 localhost vsftpd[20606]: pam_unix(vsftpd:auth): check pass; user unknown
May 25 00:48:42 localhost vsftpd[20606]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=test123 rhost=201-211-198-200.genericrev.cantv.net 
May 25 00:48:42 localhost vsftpd[20606]: pam_succeed_if(vsftpd:auth): error retrieving information about user test123
May 25 00:48:48 localhost vsftpd[20608]: pam_unix(vsftpd:auth): check pass; user unknown
May 25 00:48:48 localhost vsftpd[20608]: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=test123 rhost=201-211-198-200.genericrev.cantv.net 
May 25 00:48:48 localhost vsftpd[20608]: pam_succeed_if(vsftpd:auth): error retrieving information about user test123

[vsftpd-iptables]

enabled  = true
filter   = vsftpd
action   = iptables[name=VSFTPD, port=ftp, protocol=tcp]
           sendmail-whois[name=VSFTPD, dest=you@example.com]
logpath  = /var/log/secure
maxretry = 4
bantime  = 259200

# Fail2Ban filter for vsftp
#

[INCLUDES]

before = common.conf

[Definition]

__pam_re=\(?pam_unix(?:\(\S+\))?\)?:?
_daemon =  vsftpd

failregex = ^%(__prefix_line)s%(__pam_re)s\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=(ftp)? ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
            ^ \[pid \d+\] \[.+\] FAIL LOGIN: Client "<HOST>"\s*$

ignoreregex = 

# Author: Cyril Jaquier