CentOS ssh jail template actually needs "sshd"

[7yl4r]

I'm guessing this is a typo but it may be something intentional. The template for CentOS (/templates/Final/etc/fail2ban/jail.conf.erb) contains the following lines:

enabled = <%= scope['::fail2ban::jails'].include? "sshd" %>
...
enabled = <%= scope['::fail2ban::jails'].include? "sshd-ddos" %>

This means that by default no jails are activated on CentOS, because default jails include

fail2ban::jails:
    - 'ssh'
    - 'ssh-ddos'

but the centos template is checking for sshd and sshd-ddos.

A workaround to apply the same config to CentOS and other (Ubuntu for example) machines is to include the (undocumented) sshd jails as well as the ssh ones:

fail2ban::jails:
    - 'ssh'
    - 'sshd'
    - 'ssh-ddos'
    - 'sshd-ddos'