I have locked the root account on my server with passwd -l root
and so an attempted login results in the following in /var/log/auth.log
:
User root not allowed because account is locked
Fail2Ban does not pick these up and so the attempts continue for extended periods. How can I adjust Fail2Ban to recognise these?
Full message example:
Apr 10 13:32:28 server sshd[pid]: User root not allowed because account is locked
Jan 11 11:19:54 <hostname> sshd[19285]: User root not allowed because account is locked
Jan 11 11:19:54 <hostname> sshd[19285]: Received disconnect from 61.184.247.3 port 39292:11: [preauth]
Jan 11 11:19:54 <hostname> sshd[19285]: Disconnected from invalid user root 61.184.247.3 port 39292 [preauth]