I have a couple issues with this server. The hostname seems to be correct but in the email it’s showing localhost. Also, I don’t have any idea why it would be allowing SSH login attempts. I checked the sshd config and password authentication is set to no, RSS key is installed, and the firewall is only allowing people listed in the “networks” page.
I’ve tried restarting fail2ban, re-entering the hostname, and rebooting the pbx.
I removed the email address from Intrusion Detection (and restarted it) and Notification Settings in Sysadmin Pro but the emails continue to pour in.
This may be a dumb question but are you sure the PBX you are working on is the one that is emailing you?
Do you see the blocked IPs in the ID?
Turns out an old on premise server had been plugged back in… got it located and taken care of.
I have had similar instances which is what made me think of that.
Glad you were able to figure it out.
This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.
