0

I am running fail2ban (0.9.6-2) on Debian 9 with busybox-syslogd logging to /var/log/auth.log setup with the following line in /etc/rc.local to get logs written to file.

/sbin/syslogd -O /var/log/auth.log || exit 1

SSHD jail is enabled but does not see failed login attempts

running fail2ban-regex on the auth.log file with the sshd filter gives no fails.

sshd_config set to AUTHPRIV and VERBOSE

Here is a sample of auth.log logs:

   Jan 14 17:12:41 Fire-Video authpriv.info sshd[2556]: Failed none for video from 192.168.60.5 port 56068 ssh2
Jan 14 17:12:42 Fire-Video authpriv.info sshd[2556]: Failed password for video from 192.168.60.5 port 56068 ssh2
Jan 14 17:12:42 Fire-Video authpriv.info sshd[2556]: Failed password for video from 192.168.60.5 port 56068 ssh2
Jan 14 17:12:42 Fire-Video authpriv.info sshd[2556]: Connection closed by 192.168.60.5 port 56068 [preauth]
Jan 14 17:12:49 Fire-Video authpriv.info sshd[2558]: Connection from 192.168.60.5 port 56074 on 192.168.40.19 port 22
Jan 14 17:12:53 Fire-Video authpriv.debug sshd[2558]: pam_usermapper(sshd:auth): pam_sm_authenticate flags: 00000001
Jan 14 17:12:53 Fire-Video authpriv.notice sshd[2558]: pam_usermapper(sshd:auth): aliasing to 'root'
Jan 14 17:12:53 Fire-Video authpriv.notice sshd[2558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.60.5  user=root
Jan 14 17:12:55 Fire-Video authpriv.info sshd[2558]: Failed password for video from 192.168.60.5 port 56074 ssh2
Jan 14 17:13:15 Fire-Video authpriv.debug sshd[2558]: pam_usermapper(sshd:auth): pam_sm_authenticate flags: 00000001
Jan 14 17:13:16 Fire-Video authpriv.info sshd[2558]: Failed password for video from 192.168.60.5 port 56074 ssh2
Jan 14 17:13:21 Fire-Video authpriv.debug sshd[2558]: pam_usermapper(sshd:auth): pam_sm_authenticate flags: 00000001
Jan 14 17:13:21 Fire-Video authpriv.info sshd[2558]: Accepted password for video from 192.168.60.5 port 56074 ssh2
Jan 14 17:13:21 Fire-Video authpriv.info sshd[2558]: pam_unix(sshd:session): session opened for user root by (uid=0)

This is my sshd.conf in filter.d

      # PasswordAuthentication in sshd_config.
    #
    #
    # "Connection from <HOST> port \d+" requires LogLevel VERBOSE in sshd_config
    #
    
    [INCLUDES]
    
    # Read common prefixes. If any customizations available -- read them from
    # common.local
    before = common.conf
    
    [Definition]
    
    _daemon = sshd
    
    failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|error|failed) for .* from <HOST>( via \S+)?\s*$
                ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
                ^%(__prefix_line)sFailed \S+ for (?P<cond_inv>invalid user )?(?P<user>(?P<cond_user>\S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+)) from <HOST>(?: port \d+)?(?: ssh\d*)?(?(cond_user):|(?:(?:(?! from ).)*)$)
                ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
                ^%(__prefix_line)s[iI](?:llegal|nvalid) user .*? from <HOST>(?: port \d+)?\s*$
                ^%(__prefix_line)sUser .+ from <HOST> not allowed because not listed in AllowUsers\s*$
                ^%(__prefix_line)sUser .+ from <HOST> not allowed because listed in DenyUsers\s*$
                ^%(__prefix_line)sUser .+ from <HOST> not allowed because not in any group\s*$
                ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
                ^%(__prefix_line)s(?:error: )?Received disconnect from <HOST>: 3: .*: Auth fail(?: \[preauth\])?$
                ^%(__prefix_line)sUser .+ from <HOST> not allowed because a group is listed in DenyGroups\s*$
                ^%(__prefix_line)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$
                ^(?P<__prefix>%(__prefix_line)s)User .+ not allowed because account is locked<SKIPLINES>(?P=__prefix)(?:error: )?Received disconnect from <HOST>: 11: .+ \[preauth\]$
                ^(?P<__prefix>%(__prefix_line)s)Disconnecting: Too many authentication failures for .+? \[preauth\]<SKIPLINES>(?P=__prefix)(?:error: )?Connection closed by <HOST> \[preauth\]$
                ^(?P<__prefix>%(__prefix_line)s)Connection from <HOST> port \d+(?: on \S+ port \d+)?<SKIPLINES>(?P=__prefix)Disconnecting: Too many authentication failures for .+? \[preauth\]$
                ^%(__prefix_line)s(error: )?maximum authentication attempts exceeded for .* from <HOST>(?: port \d*)?(?: ssh\d*)? \[preauth\]$
                ^%(__prefix_line)spam_unix\(sshd:auth\):\s+authentication failure;\s*logname=\S*\s*uid=\d*\s*euid=\d*\s*tty=\S*\s*ruser=\S*\s*rhost=<HOST>\s.*$
    
    ignoreregex = 
    
    [Init]
    
    # "maxlines" is number of log lines to buffer for multi-line regex searches
    maxlines = 10
    
    journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=sshd

# DEV Notes:
#
#   "Failed \S+ for .*? from <HOST>..." failregex uses non-greedy catch-all because
#   it is coming before use of <HOST> which is not hard-anchored at the end as well,
#   and later catch-all's could contain user-provided input, which need to be greedily
#   matched away first.
#
# Author: Cyril Jaquier, Yaroslav Halchenko, Petr Voralek, Daniel Black
1

The problem with all of these is that the __prefix_line does not match busybox syslogd's strange log format. Thus fail2ban cannot make sense of any log entry created by busybox.

You can try to use the -S option to cause busybox syslogd to use an abbreviated log format that should match the __prefix_line but is less useful as a general log.

/sbin/syslogd -S -O /var/log/auth.log || exit 1
3
  • Thanks! That worked. I am wondering though what's the point of using busybox instead of syslog or rsyslog? (I think mostly because busybox has a small footprint right?) – Petrushka Jan 15 at 4:06
  • @Petrushka You would use it if you are running an embedded system with extremely limited RAM. – Michael Hampton Jan 15 at 4:58
  • OK, Thank you Michael. – Petrushka Jan 16 at 0:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.