First, the wiki page about fail2ban http://wiki.freeswitch.org/wiki/Fail2ban has this bit of tantalizing, but cryptic advice: "Enable "log-auth-failures" on each Sofia profile to monitor -- this requires a high enough loglevel on your logs to save these messages. " What does "high enough" mean? ( It looks like the default in autoload_configs/syslog.conf.xml is warning ) Why isn't log-auth-failures the default? ,., Looking at simple ways to block lists of IP addresses - there are WRONG ways to do this. Huge lists blocked as dynamic will reduce performance of your firewall. Looks like the best way is via ipsets: http://www.shorewall.net/ipsets.html So if you want to use Brain West’s blacklist ( http://daffy.bkw.org/blacklist.txt ) best to read up on ipsets. ,., The other bit is that it is best to block at the firewall if possible - this looks like it can be done by setting up fail2ban on the freeswitch box and setting up the action to use the ban command over ssh. actionban = ssh user@firewall.com shorewall drop <ip> actionunban = ssh user@firewall.com shorewall allow <ip> fail2ban using shorewall uses the dynamic method (appropriately due to the smaller number of IPs) If you want to see a list of what is currently blocked: $ shorewall show dynamic Will dump out a list of the currently banned IP addresses. -------------------------------------------------------------------------------- Karl Schmidt EMail Karl@xtronics.com Transtronics, Inc. WEB http://secure.transtronics.com 3209 West 9th Street Ph (785) 841-3089 Lawrence, KS 66049 FAX (785) 841-0434 The society that puts equality before freedom will end up with neither. The society that puts freedom before equality will end up with a great measure of both. - Milton Freidman --------------------------------------------------------------------------------