Блокировка вредоносных ботов для XRDP подключений через fail2ban

[Definition]
failregex = ^.*connection received from (?:.*:)?<ADDR>.*\n(?:.*\n){0,3}.*header read error
            ^.*connection received from (?:.*:)?<ADDR>.*\n(?:.*\n){0,3}.*login failed
            ^.*connection received from (?:.*:)?<ADDR>.*\n(?:.*\n){0,3}.*Cannot accept TLS
 
ignoreregex = 
		^.*connection received from (?:::ffff:)?(?:127\.0\.0\.1|::1)
 
datepattern = ^\[%%Y%%m%%d-%%H:%%M:%%S\]
 

[xrdp-auth]
enabled = true
filter = xrdp-auth
logpath = /var/log/xrdp.log
          /var/log/xrdp-sesman.log
backend = auto
 
# Читаем до 10 строк лога за раз для сопоставления IP и ошибки
maxlines = 10
 
maxretry = 2
findtime = 1d
bantime = 30m
bantime.increment = true
bantime.multiplier = 2
 
# Блокируем ВСЕ порты для нарушителя
port = 0:65535
 
bantime.overalljails = true
 
bantime.maxtime = 30d