1

Fail2ban debian jessie package not working:

On fresh debian jessie with openssh-server (tested in docker container):

root@2b29327677c8:/# cat /etc/debian_version 
8.3
root@2b29327677c8:/# apt-get install fail2ban
root@2b29327677c8:/# apt-cache policy fail2ban
fail2ban:
  Installed: 0.8.13-1
  Candidate: 0.8.13-1
  Version table:
 *** 0.8.13-1 0
        500 http://httpredir.debian.org/debian/ jessie/main amd64 Packages
        100 /var/lib/dpkg/status

root@2b29327677c8:/# service fail2ban start
Starting authentication failure monitor: fail2banERROR  No file(s) found for glob /var/log/auth.log
ERROR  Failed during configuration: Have not found any log file for ssh jail
 failed!

Debian jessie do not have /var/log/auth.log

How to use fail2ban on debian jessie to watch ssh connections ?

Improve this question
3

1 Answer 1

Reset to default
2

It appears that fail2ban version 0.9.0 introduced a systemd journal backend:

systemd journal backend has been created. This has a dependency on python-systemd. To use journal match in filters there is a "journalmatch".


However, Debian 8 (jessie) has fail2ban version 0.8.13 and the changelog as of package version 0.8.13-1 has no indication that this functionality would have been been backported either.

This seems like a bit of an oversight considering the use of systemd, but would explain your problems. (You can obviously still monitor anything that is written to plain log files.)

Improve this answer
1
  • You're correct! I can install >=0.9.0 fail2ban package with neuro.debian.net repo. But my question include how to configure fail2ban in this case. (i tried to configure it with backend=systemd and some other config without success)
    – bux
    Apr 7, 2016 at 20:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .