I used Fail2Ban on my Ubuntu server (14.04 LTS), and it mostly works well.
I recently noticed the default regex in /etc/fail2ban/filter.d/sshd.conf does not match some failed sshd login attempts.
Here is a typical line from /var/log/auth.log
Sep 28 12:03:01 dv1 sshd: Failed password for root from 188.8.131.52 port 51248 ssh2
When I try fail2ban-regex, to confirms this line is not matched:
fail2ban-regex \ 'Sep 28 12:03:01 dv1 sshd: Failed password for root from 184.108.40.206 port 51248 ssh2' \ '^%(__prefix_line)sFailed \S+ for .*? from (?: port \d*)?(?: ssh\d*)?(: (ruser .*|(\S+ ID \S+ \(serial \d+\) CA )?\S+ %(__md5hex)s(, client user ".*", client host ".*")?))?\s*$'
Can anyone help diagnose why this regex is failing to match? What would be a good fix?
Since this is hasn't been changes following "apt-get install fail2ban", I wonder if this regex has a bug.
Any help appreciated.