[OpenIndiana-discuss] fail2ban for sshd

[Jerry Kemp]

Hello Gary,

I don't have an answer on your fail2ban issue, but if you aren't able to resolve 
it, I am doing exceedingly well with a product called "denyhost".

http://denyhosts.sourceforge.net/

Jerry Kemp


On 04/24/14 05:43 AM, Gary Gendel wrote:
> Fail2ban seems to randomly miss ssh matches.  I've been hacking at the filter
> but nothing I seem to do works.  What regex are others using that works? The
> line that should catch the ones missed is:
>
> ^%(__prefix_line)s\[.*\] Failed (?:password|publickey|none|keyboard-interactive)
> for .* from <HOST>\s*$
>
> But it missed the following sequence:
>