in the default installation the sshd jail does not work. I raised the loglevel and added vsftpd jail in /etc/fail2ban/jail.d/defaults-debian.conf. Then I tried to login to the server with wrong credentials. Here is the (debug) log output: 018-06-04 12:47:25,241 fail2ban.jail [4091]: DEBUG Starting jail 'sshd' 2018-06-04 12:47:25,241 fail2ban.filterpyinotify[4091]: DEBUG [sshd] filter started (pyinotifier) 2018-06-04 12:47:25,242 fail2ban.jail [4091]: INFO Jail 'sshd' started 2018-06-04 12:47:25,243 fail2ban.jail [4091]: DEBUG Starting jail 'vsftpd' 2018-06-04 12:47:25,243 fail2ban.filterpyinotify[4091]: DEBUG [vsftpd] filter started (pyinotifier) 2018-06-04 12:47:25,244 fail2ban.jail [4091]: INFO Jail 'vsftpd' started 2018-06-04 12:47:49,728 fail2ban.filterpyinotify[4091]: DEBUG Event queue size: 16 2018-06-04 12:47:49,728 fail2ban.filterpyinotify[4091]: DEBUG <_RawEvent cookie=0 mask=0x2 name='' wd=2 > 2018-06-04 12:47:51,335 fail2ban.filterpyinotify[4091]: DEBUG Event queue size: 16 2018-06-04 12:47:51,335 fail2ban.filterpyinotify[4091]: DEBUG <_RawEvent cookie=0 mask=0x2 name='' wd=2 > 2018-06-04 12:47:54,039 fail2ban.filterpyinotify[4091]: DEBUG Event queue size: 16 2018-06-04 12:47:54,040 fail2ban.filterpyinotify[4091]: DEBUG <_RawEvent cookie=0 mask=0x2 name='' wd=2 > 2018-06-04 12:48:00,138 fail2ban.filterpyinotify[4091]: DEBUG Event queue size: 16 2018-06-04 12:48:00,139 fail2ban.filterpyinotify[4091]: DEBUG <_RawEvent cookie=0 mask=0x2 name='' wd=2 > 2018-06-04 12:48:01,171 fail2ban.filterpyinotify[4091]: DEBUG Event queue size: 16 2018-06-04 12:48:01,172 fail2ban.filterpyinotify[4091]: DEBUG <_RawEvent cookie=0 mask=0x2 name='' wd=2 > 2018-06-04 12:48:02,775 fail2ban.filterpyinotify[4091]: DEBUG Event queue size: 16 2018-06-04 12:48:02,775 fail2ban.filterpyinotify[4091]: DEBUG <_RawEvent cookie=0 mask=0x2 name='' wd=2 > 2018-06-04 12:48:04,561 fail2ban.filterpyinotify[4091]: DEBUG Event queue size: 16 2018-06-04 12:48:04,561 fail2ban.filterpyinotify[4091]: DEBUG <_RawEvent cookie=0 mask=0x2 name='' wd=2 > 2018-06-04 12:48:11,962 fail2ban.filterpyinotify[4091]: DEBUG Event queue size: 16 2018-06-04 12:48:11,962 fail2ban.filterpyinotify[4091]: DEBUG <_RawEvent cookie=0 mask=0x2 name='' wd=2 > 2018-06-04 12:48:13,100 fail2ban.filterpyinotify[4091]: DEBUG Event queue size: 16 2018-06-04 12:48:13,100 fail2ban.filterpyinotify[4091]: DEBUG <_RawEvent cookie=0 mask=0x2 name='' wd=2 > 2018-06-04 12:48:14,703 fail2ban.filterpyinotify[4091]: DEBUG Event queue size: 16 2018-06-04 12:48:14,704 fail2ban.filterpyinotify[4091]: DEBUG <_RawEvent cookie=0 mask=0x2 name='' wd=2 > 2018-06-04 12:48:16,525 fail2ban.filterpyinotify[4091]: DEBUG Event queue size: 16 2018-06-04 12:48:16,526 fail2ban.filterpyinotify[4091]: DEBUG <_RawEvent cookie=0 mask=0x2 name='' wd=2 > 2018-06-04 12:48:24,088 fail2ban.filterpyinotify[4091]: DEBUG Event queue size: 16 2018-06-04 12:48:24,089 fail2ban.filterpyinotify[4091]: DEBUG <_RawEvent cookie=0 mask=0x2 name='' wd=2 > 2018-06-04 12:48:25,264 fail2ban.filterpyinotify[4091]: DEBUG Event queue size: 16 2018-06-04 12:48:25,264 fail2ban.filterpyinotify[4091]: DEBUG <_RawEvent cookie=0 mask=0x2 name='' wd=2 > 2018-06-04 12:48:26,867 fail2ban.filterpyinotify[4091]: DEBUG Event queue size: 16 2018-06-04 12:48:26,867 fail2ban.filterpyinotify[4091]: DEBUG <_RawEvent cookie=0 mask=0x2 name='' wd=2 > 2018-06-04 12:48:28,633 fail2ban.filterpyinotify[4091]: DEBUG Event queue size: 16 2018-06-04 12:48:28,634 fail2ban.filterpyinotify[4091]: DEBUG <_RawEvent cookie=0 mask=0x2 name='' wd=2 > 2018-06-04 12:48:36,131 fail2ban.filterpyinotify[4091]: DEBUG Event queue size: 16 2018-06-04 12:48:36,131 fail2ban.filterpyinotify[4091]: DEBUG <_RawEvent cookie=0 mask=0x2 name='' wd=2 > (END) and here the /var/log/auth.log: Jun 4 09:34:47 myhost1 sshd[2549]: userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes [preauth] Jun 4 09:34:47 myhost1 sshd[2549]: userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes [preauth] Jun 4 09:34:49 myhost1 sshd[2549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.178.111 user=root Jun 4 09:34:50 myhost1 sshd[2549]: Failed password for root from 192.168.178.111 port 60668 ssh2 Jun 4 09:34:59 myhost1 sshd[2549]: message repeated 2 times: [ Failed password for root from 192.168.178.111 port 60668 ssh2] Jun 4 09:34:59 myhost1 sshd[2549]: error: maximum authentication attempts exceeded for root from 192.168.178.111 port 60668 ssh2 [preauth] Jun 4 09:34:59 myhost1 sshd[2549]: Disconnecting authenticating user root 192.168.178.111 port 60668: Too many authentication failures [preauth] Jun 4 09:34:59 myhost1 sshd[2549]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.178.111 user=root Jun 4 09:35:02 myhost1 sshd[2551]: userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes [preauth] Jun 4 09:35:02 myhost1 sshd[2551]: userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes [preauth] Jun 4 09:35:03 myhost1 sshd[2551]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.178.111 user=root Jun 4 09:35:05 myhost1 sshd[2551]: Failed password for root from 192.168.178.111 port 60674 ssh2 Jun 4 09:35:11 myhost1 sshd[2551]: message repeated 2 times: [ Failed password for root from 192.168.178.111 port 60674 ssh2] Jun 4 09:35:11 myhost1 sshd[2551]: error: maximum authentication attempts exceeded for root from 192.168.178.111 port 60674 ssh2 [preauth] Jun 4 09:35:11 myhost1 sshd[2551]: Disconnecting authenticating user root 192.168.178.111 port 60674: Too many authentication failures [preauth] Jun 4 09:35:11 myhost1 sshd[2551]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.178.111 user=root Jun 4 09:35:13 myhost1 sshd[2553]: userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes [preauth] Jun 4 09:35:13 myhost1 sshd[2553]: userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes [preauth] Jun 4 09:35:15 myhost1 sshd[2553]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.178.111 user=root Jun 4 09:35:17 myhost1 sshd[2553]: Failed password for root from 192.168.178.111 port 60676 ssh2 Jun 4 09:35:22 myhost1 sshd[2553]: message repeated 2 times: [ Failed password for root from 192.168.178.111 port 60676 ssh2] Jun 4 09:35:22 myhost1 sshd[2553]: error: maximum authentication attempts exceeded for root from 192.168.178.111 port 60676 ssh2 [preauth] Jun 4 09:35:22 myhost1 sshd[2553]: Disconnecting authenticating user root 192.168.178.111 port 60676: Too many authentication failures [preauth] Jun 4 09:35:22 myhost1 sshd[2553]: PAM 1 more authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.178.111 user=root Jun 4 09:35:23 myhost1 sshd[2555]: userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes [preauth] Jun 4 09:35:23 myhost1 sshd[2555]: userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes [preauth] Jun 4 09:35:24 myhost1 sshd[2555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.178.111 user=root Jun 4 09:35:26 myhost1 sshd[2555]: Failed password for root from 192.168.178.111 port 60680 ssh2 Jun 4 09:35:33 myhost1 sshd[2555]: message repeated 2 times: [ Failed password for root from 192.168.178.111 port 60680 ssh2] If I try "fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf" I got the right matches, but not in the fail2ban daemon. With vsftpd everything works ok. t1 sshd[2555]: error: maximum authentication attempts exceeded for root from 192.168.178.111 port 60680 ssh2 [preauth] Jun 4 09:35:33 myhost1 sshd[2555]: Disconnecting authenticating user root 192.168.178.111 port 60680: Too many authentication failures [preauth] Jun 4 09:35:33 myhost1 sshd[2555]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.178.111 user=root Jun 4 09:35:34 myhost1 sshd[2557]: userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes [preauth] Jun 4 09:35:34 myhost1 sshd[2557]: userauth_pubkey: key type ssh-dss not in PubkeyAcceptedKeyTypes [preauth] Jun 4 09:35:36 myhost1 sshd[2557]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.178.111 user=root Jun 4 09:35:38 myhost1 sshd[2557]: Failed password for root from 192.168.178.111 port 60682 ssh2 Jun 4 09:35:44 myhost1 sshd[2557]: message repeated 2 times: [ Failed password for root from 192.168.178.111 port 60682 ssh2] Jun 4 09:35:44 myhost1 sshd[2557]: error: maximum authentication attempts exceeded for root from 192.168.178.111 port 60682 ssh2 [preauth] Jun 4 09:35:44 myhost1 sshd[2557]: Disconnecting authenticating user root 192.168.178.111 port 60682: Too many authentication failures [preauth] Jun 4 09:35:44 myhost1 sshd[2557]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.178.111 user=root If I try "fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf" I got the right matches, but not in the fail2ban daemon. Here a the partial output from fail2ban-regex: Running tests ============= Use failregex filter file : sshd, basedir: /etc/fail2ban Use maxlines : 1 Use datepattern : Default Detectors Use log file : /var/log/auth.log Use encoding : UTF-8 Results ======= Failregex: 65 total |- #) [# of hits] regular expression | 4) [21] ^Failed \b(?!publickey)\S+ for (?Pinvalid user )?(?P\S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+) from (?: port \d+)?(?: on \S+(?: port \d+)?)?(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$) | 14) [26] ^pam_unix$sshd:auth$:\s+authentication failure;\s*logname=\S*\s*uid=\d*\s*euid=\d*\s*tty=\S*\s*ruser=\S*\s*rhost=\s.*(?: \[preauth\])?\s*$ | 15) [18] ^(error: )?maximum authentication attempts exceeded for .* from (?: port \d+)?(?: on \S+(?: port \d+)?)?(?: ssh\d*)?(?: \[preauth\])?\s*$ `- Ignoreregex: 0 total Date template hits: |- [# of hits] date format | [306] {^LN-BEG}(?:DAY )?MON Day %k:Minute:Second(?:\.Microseconds)?(?: ExYear)? `- Lines: 306 lines, 0 ignored, 65 matched, 241 missed [processed in 0.07 sec] Missed line(s): too many to print. Use --print-all-missed to print all 241 lines With vsftpd everything works ok. Here the content of /etc/fail2ban/jail.d/defaults-debian.conf: [sshd] enabled = true maxretry = 3 action = ufw [vsftpd] enabled = true maxretry = 3 action = ufw Have I missed something?

When	Who	Action	New State
2018-06-20	Launchpad Janitor	Expire	Expired
2018-06-20	Konrad Mauz	Reopen	Open
2018-07-06	Launchpad Janitor	Expire	Expired

Ubuntufail2ban package

History of question #669958

Ubuntu
fail2ban package