So I've been working with fail2ban recently and had the hardest time getting the sshd.conf regex to hit on the failed login attempts.  I searched and tried many different examples to no avail.

I couldn't give up though and found something very helpful, the fail2ban-regex command.  You can call the fail2ban-regex utility that will pull the failregex patterns from your conf files and evaluate them against any log file you specify.  So with Fedora I used it as such:

#>fail2ban-regex /var/log/messages /etc/fail2ban/filter.d/sshd.conf

Failregex
|- Regular expressions:
|  [1] [1] (?:Authentication failure|Failed [-/\w+]+) for .*(?: from|FROM) <HOST>
|
`- Number of matches:
   [1] 133 match(es)

I also learned a couple of more things in regards to Fedora and fail2ban, the jail.conf file has the sshd regex being evaluated against /var/log/secure, but nothing would match, ever.  So that leads me to the valid regex pattern that would react to the authentication failures against this given system.

The first thing I did was tell jail.conf that the ssh failures should be watched from /var/log/messages instead of /var/log/secure then I added this one line to my failregex code in the /etc/fail2ban/filter.d/sshd.conf :

failregex = (?:Authentication failure|Failed [-/\w+]+) for .*(?: from|FROM) <HOST>

Restarted the fail2ban service and tested a few false authentications from another host, FINALLY, success!

Hopefully this info helps someone else out there, because it had me frustrated trying to find the correct regex pattern. Enough so that I just had get over here and document it.

Cheat sheets (also known as reference cards, reference sheets, etc.) help you remember things quickly and they can also serve as some excellent wall decorations for your workspace.