fail2ban stopped banning based on sshd entries on journald Reproducible: Always Steps to Reproduce: 1. run fail2ban 2. no sshd ban occurs 3. The line "journalmatch = _SYSTEMD_UNIT=ssh.service + _COMM=ssh" on file /etc/fail2ban/filter.d/sshd.conf is incorrect and was preventing fail2ban to work. The correct entry is "journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=ssh"
You are presumably using an older version of openssh. https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8f40d76b04279142985ca0da8048356d34557849
I am using openssh-9.8_p1-r2 and it installs sshd: # emerge --oneshot -pv openssh These are the packages that would be merged, in order: Calculating dependencies... done! Dependency resolution took 3.32 s (backtrack: 0/20). [ebuild R ] net-misc/openssh-9.8_p1-r2::gentoo USE="pam pie ssl -audit (-debug) -kerberos -ldns -libedit -livecd -security-key (-selinux) -static -test -verify-sig (-xmss)" 0 KiB Total: 1 package (1 reinstall), Size of downloads: 0 KiB # grep systemd /var/db/pkg/net-misc/openssh-9.8_p1-r2/CONTENTS dir /usr/lib/systemd dir /usr/lib/systemd/system obj /usr/lib/systemd/system/sshd@.service c8978a9f3584c8757490f2a1a79c2c24 1720882797 obj /usr/lib/systemd/system/sshd.service 033c6f370f93608645b0fb2eed6a1e02 1720882797 obj /usr/lib/systemd/system/sshd.socket 4735139e66316cdf102cb99d716ad6aa 1720882797 * Searching for /usr/lib/systemd/system/sshd.service ... net-misc/openssh-9.8_p1-r2 (/usr/lib/systemd/system/sshd.service)
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a74794caf315f33baf0a2ca7ee9da1aa649b85fd commit a74794caf315f33baf0a2ca7ee9da1aa649b85fd Author: Sam James <sam@gentoo.org> AuthorDate: 2024-08-29 01:53:56 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2024-08-29 01:53:56 +0000 net-analyzer/fail2ban: fix openssh-9.8 compat harder; openrc tweak * Fix OpenSSH 9.8 harder by backporting more patches from upstream * Backport mjo's OpenRC init script tweak for nftables Bug: https://bugs.gentoo.org/935392 Closes: https://bugs.gentoo.org/936838 Signed-off-by: Sam James <sam@gentoo.org> net-analyzer/fail2ban/fail2ban-1.1.0-r2.ebuild | 138 +++++++++++++++++++++ .../files/fail2ban-1.1.0-openrc-nftables.patch | 25 ++++ .../files/fail2ban-1.1.0-openssh-9.8-fixups.patch | 40 ++++++ 3 files changed, 203 insertions(+)
