fail2ban bans me after a series of *successful* logins

I had a similar situation. Even when a successful login takes place, a 'Failed' message appears in the sshd log file (/var/log/messages) It is caused by this regular expression (see Chris S answer):

^%(__prefix_line)sFailed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$

matching lines like this from the /var/log/messages file:

Apr 18 14:07:02 hostname sshd[20972]: Failed none for root from 123.45.67.89 port 
50472 ssh2

When a user logs in successfully a 'Failed none' message still appears in the messages file.

To resolve this I changed the sshd_config file (/etc/ssh/sshd_config) to specify

LogLevel INFO

rather than

LogLevel VERBOSE

This stops the 'Failed none' message for successful logins, but retains it for login failures.

I also considered updating the sshd.conf fail2ban configuration file and adding something to the 'ignoreregex' line, but updating sshd is a cleaner solution.


You can use the ignoreip config option to tell fail2ban to ignore your IP.

http://www.fail2ban.org/wiki/index.php/Commands

Into /etc/fail2ban/jail.conf add something like

ignoreip = 127.0.0.1 192.168.0.0/24

My sshd.local file has this line to fix a similar problem. Compare yours, it should be similar:

failregex = ^%(__prefix_line)s(?:error: PAM: )?[A|a]uthentication (?:failure|error) for .* from <HOST>\s*$
            ^%(__prefix_line)sDid not receive identification string from <HOST>$
            ^%(__prefix_line)sFailed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
            ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
            ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
            ^%(__prefix_line)sUser \S+ from <HOST> not allowed because not listed in AllowUsers$
            ^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
            ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)$