0

fail2ban-regex verified that my filter matches Jan 14 07:39:41 myhost01 sshd[26433]: Connection closed by authenticating user root 127.0.0.1 port 56216 [preauth] 68 times inside auth.log, but fail2ban-client status sshd-preauth shows 0 matched filters and actions. What might I be missing?

jail.d/custom.local
[sshd-preauth]

enabled = true
logpath = /var/log/auth.log
backend = auto
banaction = disable-user
maxretry = 1
findtime = 1m
filter  = sshd-preauth
filter.d/sshd-preauth.conf
[INCLUDES]
before = common.conf

[DEFAULT]

_daemon = sshd
__pref = (?:(?:error|fatal): (?:PAM: )?)?
__suff = (?: \[preauth\])?\s*
__on_port_opt = (?: port \d+)?(?: on \S+(?: port \d+)?)?
__alg_match = (?:(?:\w+ (?!found\b)){0,2}\w+)

[Definition]
prefregex = ^<F-MLFID>%(__prefix_line)s</F-MLFID>%(__pref)s<F-CONTENT>.+</F-CONTENT>$
failregex = ^Connection closed by authenticating user root (?P<ip4>(?:\d{1,3}\.){3}\d{1,3}) port \d+ \[preauth\]$
datepattern = {^LN-BEG}
action.d/disable-user.conf
[Definition]
actionstart = touch /tmp/01234
actionstop =
actioncheck = 
actionban = touch /tmp/OSSEC
actionunban = touch /tmp/UNBAN
fail2ban-regex
fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd-preauth.conf  

Running tests

Use   failregex filter file : sshd-preauth, basedir: /etc/fail2ban
Use      datepattern : Default Detectors
Use         log file : /var/log/auth.log
Use         encoding : UTF-8


Results

Failregex: 68 total
|-  #) [# of hits] regular expression
|   1) [68] ^Connection closed by authenticating user root (?P<ip4>(?:\d{1,3}\.){3}\d{1,3}) port \d+ \[preauth\]$
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [865] {^LN-BEG}(?:DAY )?MON Day %k:Minute:Second(?:\.Microseconds)?(?: ExYear)?
`-

Lines: 865 lines, 0 ignored, 68 matched, 797 missed
[processed in 0.06 sec]

Missed line(s): too many to print.  Use --print-all-missed to print all 797 lines

UPDATE

Fail2ban filter is triggered if I ssh from LAN and not from localhost to the computer. So apparently fail2ban ignores localhost logs, even though I configured jail.conf to check for localhost too:

jail.conf

[DEFAULT] 
ignorself = false
ignoreip =

Is this a known limitation for fail2ban or is there a workaround?

Update 2 (Solution)

There are two bugs in fail2ban. The config variable should be ignoreself not ignorself. Also release < v0.10.3 have a bug. With the newest fail2ban release it works fine now.

  • What is PermitRootLogin set to in your sshd_config? – ErikF Jan 14 at 4:46
  • I get that failed ssh access on root from localhost are result from your tests, I would look if fail2ban or iptables can handle lo0 interface. – Archemar Jan 14 at 6:13
  • @ErikF PermitRootLogin is set to prohibit-password. – fremon Jan 14 at 14:10
  • @Archemar I triggered the failed ssh by entering a wrong ssh-key passphrase on purpose. ssh to localhost work fine, but I want to catch wrongly entered passphrases with fail2ban. – fremon Jan 14 at 14:13
  • @Archemar Indeed it seems ssh-logs from localhost are ignored by fail2ban, even though I configured in jail.conf: [DEFAULT] ignorself = false ignoreip =. Because when I just tried to ssh from LAN (not localhost) the filter is triggered just fine. Just from localhost it's not triggered. Any way to workaround this? – fremon Jan 14 at 14:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.