[FR]: sshd_filter not matching password authentication failed log line about fail2ban HOT 2 CLOSED

The reason for that is unexpected prefix - auth.info between hostname and service name (localhost auth.info sshd) is normally not present in log.

Either you'd change the format if syslog or whatever, so it would not generate that (no idea where one can change it)...

Or you adjust the prefix-line (e. g. rewrite default hostname of common prefix-line), either in jail.local for sshd jail only:

[sshd]
filter = %(known/filter)s[__hostname="\S+(?: [a-z]+\.[a-z]+)?"]

Or in filter.d/common.local for all jails based on common-include:

[DEFAULT]
__hostname = \S+(?: [a-z]+\.[a-z]+)?

from fail2ban.

The reason for that is unexpected prefix - auth.info between hostname and service name (localhost auth.info sshd) is normally not present in log.

Either you'd change the format if syslog or whatever, so it would not generate that (no idea where one can change it)...

Or you adjust the prefix-line (e. g. rewrite default hostname of common prefix-line), either in jail.local for sshd jail only:

[sshd]
filter = %(known/filter)s[__hostname="\S+(?: [a-z]+\.[a-z]+)?"]

Or in filter.d/common.local for all jails based on common-include:

[DEFAULT]
__hostname = \S+(?: [a-z]+\.[a-z]+)?

Hey!

I used your first method and it worked flawlessly, thank you so much.

For me this is fixed so I am going to close the issue.

from fail2ban.