I've got some troublesome hosts trying it on with an SSH server I run, and I'm trying to ban them using fail2ban. Problem is, I haven't done much work with regexes, and even less with Python regexes.
Here are the troublesome lines in my auth.log:
Nov 19 18:58:17 myhost sshd: Connection from xxx.xxx.xxx.xxx port 3284 on my.host.ip.address port 22 Nov 19 18:58:21 myhost sshd: fatal: Read from socket failed: Connection reset by peer [preauth]
I want to grab both lines in the regex, I've seen in other posts about how to do multiline stuff, but at the moment I can't even get it to match the first line! Here's a snippet from my *.conf file:
[INCLUDES] # Read common prefixes. If any customizations available -- read them from # common.local before = common.conf [Init] maxlines = 2 [Definition] _daemon = sshd failregex = ^%(__prefix_line)s^Connection from <HOST>*$
I understand that the "__prefix_line" is designed to catch the first "myhost sshd[PID]" bit, but all I when I run "fail2ban-regex" is:
Results ======= Failregex: 0 total Ignoreregex: 0 total Date template hits: |- [# of hits] date format |  MONTH Day Hour:Minute:Second `- Lines: 115124 lines, 0 ignored, 0 matched, 115124 missed
Does anyone have any ideas?
Thanks in advance!