Argthtjtr

I've been fighting setting up fail2ban version 0.10.1

I've been testing the my config file attached using the command below. This proves that the date matches, but I cannot seem to get the line to match. I'd be grateful of some pointers. I couldn't find what I needed in the fail2ban manual. Thanks.

fail2ban-regex '2018-11-23_12:13:31.77264 User root from 101.1.12.12 not allowed because not listed in AllowUsers' /config/fail2ban/filter.d/sshd.local -v --verbosity=4

my log entries to match look like this

2018-11-23_12:13:31.77264 User root from 101.1.12.12 not allowed because not listed in AllowUsers

My filter configuration file looks like this

# authentication then get public key authentication working before disabling

# PasswordAuthentication in sshd_config.                                    

#                                                                           

#                                                                           

# "Connection from <HOST> port d+" requires LogLevel VERBOSE in sshd_config

#                                                                        



[INCLUDES]                                                               



# Read common prefixes. If any customizations available -- read them from

# common.local      

before = common.conf                                                                            



[DEFAULT]                                                                                       



_daemon = sshd                                                                                  



# optional prefix (logged from several ssh versions) like "error: ", "error: PAM: " or "fatal: "

__pref = (?:(?:error|fatal): (?:PAM: )?)?                             

# optional suffix (logged from several ssh versions) like " [preauth]"               

__suff = (?: [preauth])?s*                                                        

__on_port_opt = (?: port d+)?(?: on S+(?: port d+)?)?                                                            



[Definition]                                                                                                                                                                                                



prefregex = ^<F-MLFID>%(__prefix_line)s</F-MLFID>%(__pref)s<F-CONTENT>.+</F-CONTENT>$                                                                                                                       



cmnfailre = ^[aA]uthentication (?:failure|error|failed) for <F-USER>.*</F-USER> from <HOST>( via S+)?s*%(__suff)s$                                                                                        

            ^User not known to the underlying authentication module for <F-USER>.*</F-USER> from <HOST>s*%(__suff)s$                                                                                       

            ^Failed S+ for (?P<cond_inv>invalid user )?<F-USER>(?P<cond_user>S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+)</F-USER> from <HOST>%(__on_port_opt)s(?: sshd*)?(?(cond_user): |(?:(?:(?! from ).)*

            ^<F-USER>ROOT</F-USER> LOGIN REFUSED.* FROM <HOST>s*%(__suff)s$                                

            ^User <F-USER>.+</F-USER> from <HOST> not allowed because not listed in AllowUser$              

            ^[iI](?:llegal|nvalid) user <F-USER>.*?</F-USER> from <HOST>%(__on_port_opt)ss*$                          

            ^Invalid user <F-USER>.+</F-USER> from <HOST>%(__on_port_opt)ss*$                                         

            ^User <F-USER>.+</F-USER> from <HOST> not allowed because not listed in AllowUserss*%(__suff)s$           

            ^User <F-USER>.+</F-USER> from <HOST> not allowed because listed in DenyUserss*%(__suff)s$                            

            ^User <F-USER>.+</F-USER> from <HOST> not allowed because not in any groups*%(__suff)s$                                                                 

            ^refused connect from S+ (<HOST>)s*%(__suff)s$                                                                                                       

            ^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(__on_port_opt)s:s*3: .*: Auth fail%(__suff)s$                                              

            ^User <F-USER>.+</F-USER> from <HOST> not allowed because a group is listed in DenyGroupss*%(__suff)s$                                                  

            ^User <F-USER>.+</F-USER> from <HOST> not allowed because not listed in AllowUsers$                                                  

^User <F-USER>.+</F-USER> from <HOST> not allowed because none of user's groups are listed in AllowGroupss*%(__suff)s$                                                                         

            ^pam_unix(sshd:auth):s+authentication failure;s*logname=S*s*uid=d*s*euid=d*s*tty=S*s*ruser=<F-USER>S*</F-USER>s*rhost=<HOST>s.*%(__suff)s$                                       

            ^(error: )?maximum authentication attempts exceeded for <F-USER>.*</F-USER> from <HOST>%(__on_port_opt)s(?: sshd*)?%(__suff)s$                                                                 

            ^User <F-USER>.+</F-USER> not allowed because account is locked%(__suff)s                                                                                                                       

            ^<F-MLFFORGET>Disconnecting</F-MLFFORGET>: Too many authentication failures(?: for <F-USER>.+?</F-USER>)?%(__suff)s                                                                             

            ^<F-NOFAIL>Received <F-MLFFORGET>disconnect</F-MLFFORGET></F-NOFAIL> from <HOST>: 11:                                                                                                           

            ^<F-NOFAIL>Connection <F-MLFFORGET>closed</F-MLFFORGET></F-NOFAIL> by <HOST>%(__suff)s$                                                                                                         



mdre-normal =                                                                                                                                                                                               



mdre-ddos = ^Did not receive identification string from <HOST>%(__suff)s$                                                                                                                                   

            ^Connection <F-MLFFORGET>reset</F-MLFFORGET> by <HOST>%(__on_port_opt)s%(__suff)s                                                                                                               

            ^<F-NOFAIL>SSH: Server;Ltype:</F-NOFAIL> (?:Authname|Version|Kex);Remote: <HOST>-d+;[A-Z]w+:                                                                                                  

            ^Read from socket failed: Connection <F-MLFFORGET>reset</F-MLFFORGET> by peer%(__suff)s                                                                                                         



mdre-extra = ^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(__on_port_opt)s:s*14: No supported authentication methods available%(__suff)s$                                                   

            ^Unable to negotiate with <HOST>%(__on_port_opt)s: no matching (?:cipher|key exchange method) found.                                                                                            

            ^Unable to negotiate a (?:cipher|key exchange method)%(__suff)s$                                                                                                                                



mdre-aggressive = %(mdre-ddos)s                                                                                                                                                                             

                  %(mdre-extra)s                                                                                                                                                                            



cfooterre = ^<F-NOFAIL>Connection from</F-NOFAIL> <HOST>                                                                                                                                                    



failregex = %(cmnfailre)s                                                                                                                                                                                   

            <mdre-<mode>>                                                                                                                                                                                   

            %(cfooterre)s               



# Parameter "mode": normal (default), ddos, extra or aggressive (combines all)                                                                                                                              

# Usage example (for jail.local):                                                                                                                                                                           

#   [sshd]                                                                                                                                                                                                  

#   mode = extra                                                                                                                                                                                            

#   # or another jail (rewrite filter parameters of jail):                                                                                                                                                  

#   [sshd-aggressive]                                                                                                                                                                                       

#   filter = sshd[mode=aggressive]                                                                                                                                                                          

#                                                                                                                                                                                                           

mode = normal                                                                                                                                                                                               



#filter = sshd[mode=aggressive]                                                                                                                                                                             



ignoreregex =                                                                                                                                                                                               



maxlines = 1                                                                                                                                                                                                



journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=sshd                                                                                                                                                      



datepattern = %%Y-%%m-%%d_%%H:%%M:%%S.%%f                                                                                                                                                                   

              {^LN-BEG}%%Y-%%m-%%d_%%H:%%M:%%S.%%f                                                                                                                                                          

              {^LN-BEG}              

# DEV Notes:                                                                                                                                                         

#                                                                                                                                                                    

#   "Failed S+ for .*? from <HOST>..." failregex uses non-greedy catch-all because                                                                                  

#   it is coming before use of <HOST> which is not hard-anchored at the end as well,                                                                                 

#   and later catch-all's could contain user-provided input, which need to be greedily                                                                               

#   matched away first.                                                                                                                                              

#                                                                                                                                                                    

# Author: Cyril Jaquier, Yaroslav Halchenko, Petr Voralek, Daniel Black and Sergey Brester aka sebres                                                                

# Rewritten using prefregex (and introduced "mode" parameter) by Serg G. Brester.