fail2ban does not work on Rocky Linux 8.9

[marcushsu]

Environment:

Fail2Ban version (including any possible distribution suffixes): 1.0.2
OS, including release name/version: Rocky Linux 8.9
☑️Fail2Ban installed via OS/distribution mechanisms
☑️You have not applied any additional foreign patches to the codebase

The issue:

fail2ban ignores every ssh authentication error.

jail.local

[sshd]
enabled = true

fail2ban-client status

Status
|- Number of jail:      1
`- Jail list:   sshd

fail2ban-client status sshd

Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- Journal matches:  _SYSTEMD_UNIT=sshd.service + _COMM=sshd
`- Actions
   |- Currently banned: 0
   |- Total banned:     0
   `- Banned IP list:

fail2ban-regex systemd-journal sshd

Running tests
=============

Use   failregex filter file : sshd, basedir: /etc/fail2ban
Use         maxlines : 1
Use      datepattern : {^LN-BEG} : Default Detectors
Use         systemd journal
Use         encoding : UTF-8
Use    journal match : _SYSTEMD_UNIT=sshd.service + _COMM=sshd


Results
=======

Prefregex: 23298 total
|  ^(?P<mlfid>\s*(?:\S+\s+)?(?:sshd(?:\[\d+\])?:?\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?)(?:(?:error|fatal): (?:PAM: )?)?(?P<content>.+)$
`-

Failregex: 13394 total
|-  #) [# of hits] regular expression
|  14) [13394] ^<F-NOFAIL>pam_[a-z]+\(sshd:auth\):\s+authentication failure;</F-NOFAIL>(?:\s+(?:(?:logname|e?uid|tty)=\S*)){0,4}\s+ruser=<F-ALT_USER>\S*</F-ALT_USER>\s+rhost=<HOST>(?:\s+user=<F-USER>\S*</F-USER>)?(?: (?:port \d+|on \S+|\[preauth\])){0,3}\s*$
`-

Ignoreregex: 0 total

Date template hits:

Lines: 23298 lines, 13394 ignored, 0 matched, 9904 missed
[processed in 20.23 sec]

Ignored line(s): too many to print.  Use --print-all-ignored to print all 13394 lines
Missed line(s): too many to print.  Use --print-all-missed to print all 9904 lines

fail2ban-regex systemd-journal sshd --print-all-ignored

=============

Use   failregex filter file : sshd, basedir: /etc/fail2ban
Use         maxlines : 1
Use      datepattern : {^LN-BEG} : Default Detectors
Use         systemd journal
Use         encoding : UTF-8
Use    journal match : _SYSTEMD_UNIT=sshd.service + _COMM=sshd


Results
=======

Prefregex: 23298 total
|  ^(?P<mlfid>\s*(?:\S+\s+)?(?:sshd(?:\[\d+\])?:?\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?)(?:(?:error|fatal): (?:PAM: )?)?(?P<content>.+)$
`-

Failregex: 13394 total
|-  #) [# of hits] regular expression
|  14) [13394] ^<F-NOFAIL>pam_[a-z]+\(sshd:auth\):\s+authentication failure;</F-NOFAIL>(?:\s+(?:(?:logname|e?uid|tty)=\S*)){0,4}\s+ruser=<F-ALT_USER>\S*</F-ALT_USER>\s+rhost=<HOST>(?:\s+user=<F-USER>\S*</F-USER>
)?(?: (?:port \d+|on \S+|\[preauth\])){0,3}\s*$
`-

Ignoreregex: 0 total

Date template hits:

Lines: 23298 lines, 13394 ignored, 0 matched, 9904 missed
[processed in 19.66 sec]

|- Ignored line(s):
|  2024-04-13T23:31:36.306018 g.getinto.network sshd[519505]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.158.153  user=root
|  2024-04-13T23:31:57.296433 g.getinto.network sshd[519507]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.158.153
|  2024-04-13T23:32:18.297954 g.getinto.network sshd[519540]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.158.153  user=root
|  2024-04-13T23:32:38.681349 g.getinto.network sshd[519542]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.158.153
|  2024-04-21T08:40:57.347402 g.getinto.network sshd[695851]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.167.65.128
|  2024-04-21T08:40:57.949436 g.getinto.network sshd[695853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.167.65.128
|  2024-04-21T08:40:58.566319 g.getinto.network sshd[695855]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.167.65.128
|  2024-04-21T08:40:59.324406 g.getinto.network sshd[695857]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.167.65.128
...(CTRL-C)...

lastb

<p>The   ssh:notty    118.167.65.128   Sun Apr 21 08:41 - 08:41  (00:00)
<h1>Not  ssh:notty    118.167.65.128   Sun Apr 21 08:41 - 08:41  (00:00)
<title>4 ssh:notty    118.167.65.128   Sun Apr 21 08:41 - 08:41  (00:00)
<!DOCTYP ssh:notty    118.167.65.128   Sun Apr 21 08:40 - 08:40  (00:00)
<p>The   ssh:notty    118.167.65.128   Sun Apr 21 08:40 - 08:40  (00:00)
<h1>Not  ssh:notty    118.167.65.128   Sun Apr 21 08:40 - 08:40  (00:00)
<title>4 ssh:notty    118.167.65.128   Sun Apr 21 08:40 - 08:40  (00:00)
<!DOCTYP ssh:notty    118.167.65.128   Sun Apr 21 08:40 - 08:40  (00:00)
wangs    ssh:notty    178.128.158.153  Sat Apr 13 23:32 - 23:32  (00:00)
wangs    ssh:notty    178.128.158.153  Sat Apr 13 23:32 - 23:32  (00:00)
root     ssh:notty    178.128.158.153  Sat Apr 13 23:32 - 23:32  (00:00)
guozheng ssh:notty    178.128.158.153  Sat Apr 13 23:31 - 23:31  (00:00)
guozheng ssh:notty    178.128.158.153  Sat Apr 13 23:31 - 23:31  (00:00)
root     ssh:notty    178.128.158.153  Sat Apr 13 23:31 - 23:31  (00:00)
...(CTRL-C)...

[sebres]

See #3189 (comment) and below for similar issue.

Hints:

1. LogLevel VERBOSE (I guess it'd solve that)
2. If it doesn't work try to correct failregex as suggested in further comment

Normally (since #2090, the pam-messages are ignored as no failure (it is just a helper to recognize IP for session-ID), because otherwise the filter would consider single attempt as 2 failures, so jail would ban double as fast than specified in maxretry.
Just in your case it seems not to find another messages at all.

Lines: 23298 lines, 13394 ignored, 0 matched, 9904 missed

It would be good to know what exactly are that 9904 missed messages (maybe filter cannot recognize something here).
So try following command and provide the output from missed block (few lines with different types of messages):

fail2ban-regex --print-all-missed systemd-journal sshd

[marcushsu]

Thank you. I've tried the failregrex as suggested but it doesn't work.
The missed block is as follows:

Running tests
=============

Use   failregex filter file : sshd, basedir: /etc/fail2ban
Use         maxlines : 1
Use      datepattern : {^LN-BEG} : Default Detectors
Use         systemd journal
Use         encoding : UTF-8
Use    journal match : _SYSTEMD_UNIT=sshd.service + _COMM=sshd


Results
=======

Prefregex: 23298 total
|  ^(?P<mlfid>\s*(?:\S+\s+)?(?:sshd(?:\[\d+\])?:?\s+)?(?:kernel:\s?\[ *\d+\.\d+\]:?\s+)?)(?:(?:error|fatal): (?:PAM: )?)?(?P<content>.+)$
`-

Failregex: 13394 total
|-  #) [# of hits] regular expression
|  14) [13394] ^<F-NOFAIL>pam_[a-z]+\(sshd:auth\):\s+authentication failure;</F-NOFAIL>(?:\s+(?:(?:logname|e?uid|tty)=\S*)){0,4}\s+ruser=<F-ALT_USER>\S*</F-ALT_USER>\s+rhost=<HOST>(?:\s+user=<F-USER>\S*</F-USER>
)?(?: (?:port \d+|on \S+|\[preauth\])){0,3}\s*$
`-

Ignoreregex: 0 total

Date template hits:

Lines: 23298 lines, 13394 ignored, 0 matched, 9904 missed
[processed in 21.39 sec]

Ignored line(s): too many to print.  Use --print-all-ignored to print all 13394 lines
|- Missed line(s):
...(omitted)...
|  2024-04-13T23:31:15.338671 g.getinto.network sshd[519503]: pam_unix(sshd:auth): check pass; user unknown
|  2024-04-13T23:31:57.296274 g.getinto.network sshd[519507]: pam_unix(sshd:auth): check pass; user unknown
|  2024-04-13T23:32:38.681175 g.getinto.network sshd[519542]: pam_unix(sshd:auth): check pass; user unknown
|  2024-04-21T08:35:32.981486 g.getinto.network sshd[695737]: error: kex_exchange_identification: Connection closed by remote host
|  2024-04-21T08:40:57.347233 g.getinto.network sshd[695851]: pam_unix(sshd:auth): check pass; user unknown
|  2024-04-21T08:40:57.949276 g.getinto.network sshd[695853]: pam_unix(sshd:auth): check pass; user unknown
|  2024-04-21T08:40:58.566140 g.getinto.network sshd[695855]: pam_unix(sshd:auth): check pass; user unknown
|  2024-04-21T08:40:59.324223 g.getinto.network sshd[695857]: pam_unix(sshd:auth): check pass; user unknown
`