1

I used Fail2Ban on my Ubuntu server (14.04 LTS), and it mostly works well.

I recently noticed the default regex in /etc/fail2ban/filter.d/sshd.conf does not match some failed sshd login attempts.

Here is a typical line from /var/log/auth.log

Sep 28 12:03:01 dv1 sshd[30636]: Failed password for root from 14.160.56.206 port 51248 ssh2

When I try fail2ban-regex, to confirms this line is not matched:

fail2ban-regex \
'Sep 28 12:03:01 dv1 sshd[30636]: Failed password for root from 14.160.56.206 port 51248 ssh2' \
'^%(__prefix_line)sFailed \S+ for .*? from (?: port \d*)?(?: ssh\d*)?(: (ruser .*|(\S+ ID \S+ \(serial \d+\) CA )?\S+ %(__md5hex)s(, client user ".*", client host ".*")?))?\s*$'

Can anyone help diagnose why this regex is failing to match? What would be a good fix?

Since this is hasn't been changes following "apt-get install fail2ban", I wonder if this regex has a bug.

Any help appreciated.

  • from my point of view it looks like a bug. The regex is more complicated than in the older versions, but I don't see the problem in this late hour. – Jakuje Sep 28 '15 at 21:18
  • Does it work for you if you try it with a file like this: fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf I got the matches correctly on that line with old Debian. – Jakuje Sep 29 '15 at 17:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.