Fail2ban stopped working on FreeBSD with default settings, so check if you're still using old configurations
Hello, I'm Munou.
Recently, for some reason, IP banning was no longer working for the sshd rule in fail2ban on FreeBSD.
Current Rules
It looks like this.
jail.local :
[sshd]
enabled = true
port = all
filter = sshd
allowipv6 = auto
logpath = /var/log/auth.log
bantime = 10w
findtime = 1w
maxretry = 3However, the hetzner side is working. Why?
Update
It seems the settings have been updated on the fail2ban side as well, and those who have installed it recently should have the fix.
Correct:
[DEFAULT]
_daemon = sshd(?:-session)?Incorrect:
[DEFAULT]
_daemon = sshdThe previous sshd binary is now split into a listener binary sshd and a per-session binary sshd-session
There are changes to some log messages
OpenSSH 9.8p1 has been released
sshd(8): the server has been split into a listener binary, sshd(8),
and a per-session binary "sshd-session". This allows for a much
smaller listener binary, as it no longer needs to support the SSH
protocol. As part of this work, support for disabling privilege
separation (which previously required code changes to disable) and
disabling re-execution of sshd(8) has been removed. Further
separation of sshd-session into additional, minimal binaries is
planned for the future.sshd(8): The server is split into a listener binary sshd(8) and a per-session binary
"sshd-session". This allows the listener binary size to be
made much smaller, as it no longer needs to support the SSH protocol.
As part of this work, support for disabling privilege separation (which previously
required code changes to disable) and support for disabling the re-execution of sshd(8)
are removed. Further separation of sshd-session into additional minimal (functional) unit
binaries is planned for the future.
Checking if rules match fail2ban regex
After making the fix, check with the following:
fail2ban-regex /var/log/auth.log /usr/local/etc/fail2ban/filter.d/sshd.confI've had it running since yesterday, and it's catching quite a lot.
In my case, anyone trying to connect via sshd is clearly a bad actor, so I have a strict rule of a 10-week ban. Those trying to do bad things across various protocols get a harsh sentence of a 52-week ban.
I'd like to output this as a report periodically.
# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
| |- Currently failed: 18
| |- Total failed: 201
| `- File list: /var/log/auth.log
`- Actions
|- Currently banned: 16
|- Total banned: 16
`- Banned IP list: 76.164.199.128 213.209.159.159 211.215.17.214 80.94.92.184 27.79.3.114 62.210.236.6 45.148.10.121 175.199.67.164 151.115.61.11 103.251.247.158 161.132.53.175 103.193.177.213 37.77.150.223 2.57.121.112 2.57.122.238 2001:db8::1Another server that has been active all along
# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
| |- Currently failed: 9
| |- Total failed: 136
| `- Journal matches: _SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
|- Currently banned: 217
|- Total banned: 217