I am currently trying to catch failed SSH login attempts with certificate based authentication (certificate correct but wrong password) using fail2ban version 0.11.2-2 (running on Debian 11).
Therefore I created a new file
/etc/fail2ban/filter.d/sshd.local with the content
[Definition] failregex = %(known/failregex)s ^%(__prefix_line)sConnection closed by authenticating user <F-USER>.+</F-USER> <HOST> port \d+ \[preauth\]$
so that the filter rule is not overwritten in future updates.
To test this, I caused the situation myself a few times and can confirm with
sudo fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.local that the filter finds the log entries:
-  ^(?:)?\s*(?:<[^.]+.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?[ *\d+.\d+]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:[\d+])?:\s+[[(]?sshd(?:(\S+))?)]?:?|[[(]?sshd(?:(\S+))?)]?:?(?:[\d+])?:?)\s+)?(?:[ID \d+ \S+]\s+)?Connection closed by authenticating user .+ port \d+ [preauth]$
But nothing happens on the filter status:
Status for the jail: sshd |- Filter | |- Currently failed: 0 | |- Total failed: 0 | - File list: /var/log/auth.log - Actions |- Currently banned: 0 |- Total banned: 0 - Banned IP list:
Do you have any ideas what is not working here or where else I should look?