Fail2ban debian jessie package not working:

On fresh debian jessie with openssh-server (tested in docker container):

root@2b29327677c8:/# cat /etc/debian_version 
root@2b29327677c8:/# apt-get install fail2ban
root@2b29327677c8:/# apt-cache policy fail2ban
  Installed: 0.8.13-1
  Candidate: 0.8.13-1
  Version table:
 *** 0.8.13-1 0
        500 http://httpredir.debian.org/debian/ jessie/main amd64 Packages
        100 /var/lib/dpkg/status

root@2b29327677c8:/# service fail2ban start
Starting authentication failure monitor: fail2banERROR  No file(s) found for glob /var/log/auth.log
ERROR  Failed during configuration: Have not found any log file for ssh jail

Debian jessie do not have /var/log/auth.log

How to use fail2ban on debian jessie to watch ssh connections ?


It appears that fail2ban version 0.9.0 introduced a systemd journal backend:

systemd journal backend has been created. This has a dependency on python-systemd. To use journal match in filters there is a "journalmatch".

However, Debian 8 (jessie) has fail2ban version 0.8.13 and the changelog as of package version 0.8.13-1 has no indication that this functionality would have been been backported either.

This seems like a bit of an oversight considering the use of systemd, but would explain your problems. (You can obviously still monitor anything that is written to plain log files.)

| improve this answer | |
  • You're correct! I can install >=0.9.0 fail2ban package with neuro.debian.net repo. But my question include how to configure fail2ban in this case. (i tried to configure it with backend=systemd and some other config without success) – bux Apr 7 '16 at 20:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.