--- fail2ban.conf.orig  2010-02-25 15:00:00.000000000 +0100
+++ fail2ban.conf       2010-02-25 14:52:22.000000000 +0100
@@ -22,7 +22,7 @@
 #          Only one log target can be specified.
 # Values:  STDOUT STDERR SYSLOG file  Default:  /var/log/fail2ban.log
 #
-logtarget = /var/log/fail2ban.log
+logtarget = /var/log/fail2ban/fail2ban.log

 # Option: socket
 # Notes.: Set the socket file. This is used to communicate with the daemon. Do

--- jail.conf.orig      2012-08-01 03:45:04.000000000 +0200
+++ jail.conf   2012-12-08 02:24:25.000000000 +0100
@@ -23,14 +23,14 @@
 ignoreip = 127.0.0.1/8

 # "bantime" is the number of seconds that a host is banned.
-bantime  = 600
+bantime  = 1200

 # A host is banned if it has generated "maxretry" during the last "findtime"
 # seconds.
-findtime  = 600
+findtime  = 60

 # "maxretry" is the number of failures before a host get banned.
-maxretry = 3
+maxretry = 2

 # "backend" specifies the backend used to get files modification.
 # Available options are "pyinotify", "gamin", "polling" and "auto".
@@ -219,12 +219,11 @@

 [ssh-ipfw]

-enabled  = false
+enabled  = true
 filter   = sshd
-action   = ipfw[localhost=192.168.0.1]
-           sendmail-whois[name="SSH,IPFW", dest=you@example.com]
+action   = ipfw[localhost=37.59.20.105]
 logpath  = /var/log/auth.log
-ignoreip = 168.192.0.1
+ignoreip = 91.121.4.86 62.111.156.254

 # These jails block attacks against named (bind9). By default, logging is off
 # with bind9 installation. You will need something like this:

--- ipfw.conf.orig      2012-08-01 03:45:04.000000000 +0200
+++ ipfw.conf   2012-12-08 02:14:46.000000000 +0100
@@ -12,14 +12,14 @@
 # Notes.:  command executed once at the start of Fail2Ban.
 # Values:  CMD
 #
-actionstart =
+actionstart = ipfw add 64000 deny ip from table\(22\) to any


 # Option:  actionstop
 # Notes.:  command executed once at the end of Fail2Ban
 # Values:  CMD
 #
-actionstop =
+actionstop = ipfw delete 64000


 # Option:  actioncheck
@@ -37,7 +37,7 @@
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionban = ipfw add deny tcp from <ip> to <localhost> <port>
+actionban = ipfw table 22 add <ip>


 # Option:  actionunban
@@ -48,7 +48,7 @@
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 #
-actionunban = ipfw delete `ipfw list | grep -i <ip> | awk '{print $1;}'`
+actionunban = ipfw table 22 delete <ip>

 [Init]

@@ -62,4 +62,4 @@
 # Notes.:  the local IP address of the network interface
 # Values:  IP
 #
-localhost = 127.0.0.1
+localhost = 37.59.20.105176.241.247.193

--- sshd.conf.orig      2008-05-12 10:31:56.000000000 +0200
+++ sshd.conf   2010-02-25 15:06:49.000000000 +0100
@@ -2,7 +2,7 @@
 #
 # Author: Cyril Jaquier
 #
-# $Revision: 663 $
+# $Revision: 728 $
 #

 [INCLUDES]
@@ -20,17 +20,20 @@
 # Notes.:  regex to match the password failures messages in the logfile. The
 #          host must be matched by a group named "host". The tag "<HOST>" can
 #          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>\S+)
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
-            ^%(__prefix_line)sFailed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
+failregex = ^%(__prefix_line)s(?:error: PAM: )?[A|a]uthentication (?:failure|error) for .* from <HOST>\s*$
+            ^%(__prefix_line)sDid not receive identification string from <HOST>$
+            ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
+            ^%(__prefix_line)sFailed (?:password|publickey) for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
             ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
             ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
             ^%(__prefix_line)sUser \S+ from <HOST> not allowed because not listed in AllowUsers$
             ^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
             ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
-            ^%(__prefix_line)sAddress <HOST> .* POSSIBLE BREAK-IN ATTEMPT\s*$
+            ^%(__prefix_line)sreverse mapping checking getaddrinfo for .* \[<HOST>\] .* POSSIBLE BREAK-IN ATTEMPT!$
+            ^%(__prefix_line)sUser \S+ from <HOST> not allowed because none of user's groups are listed in AllowGroups$

 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.