Cela revient à faire une règle sur 'Ban' dans les logs.
sudo nano /etc/fail2ban/filter.d/ban.conf
# Fail2Ban configuration file
#
# Author: Nicolargo
#
[Definition]
# Option: failregex
# Filter Ban in the fail2ban.log
failregex = .*Ban\ <HOST>
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
jail.local
...
# Multi Ban
# 3 ban in 1 hour > Ban for 1 hour
[multi-ban]
enabled = true
filter = ban
logpath = /var/log/fail2ban.log
maxretry = 3
findtime = 3600
...
Source:
http://blog.nicolargo.com/2012/03/bannir-les-bannis-avec-fail2ban.html
