https://gist.github.com/dasgoll/5c7c02f363e7aeaff2837d650d985cc7

EX: *.ccdd.com

openssl req  -subj "/C=cd/CN=*.ccdd.com" -x509 -nodes -days 365 -newkey rsa:2048 -keyout ccdd-wildcard-selfsigned.key -out ccdd-wildcard-selfsigned.crt



# /etc/fail2ban/jail.local
[DEFAULT]
default_backend = systemd
logtarget = SYSTEMD-JOURNAL
# /etc/fail2ban/jail.d/named.conf
[named-refused-tcp]
backend = systemd

How to check

  1. journalctl -r
  2. less /var/log/fail2ban.log
  3. fail2ban-client status or fail2ban-client status sshd or fail2ban-client status ooxxooxx