raspbian Linux [hostname] 4.9.36+ #1015 Thu Jul 6 16:07:57 BST 2017 armv6l GNU/Linux
fail2ban is not picking up the dropbear auth failures. This was working for openssh without issues. I went to dropbear to reduce memory usage.
Here is my auth.log to show logging is working
dropbear[2640]: Bad password attempt for 'username' from 192.168.1.151:50780 My jail.local
#dropbear shh config password [dropbear] enabled = true port = ssh filter = dropbear logpath = /var/log/auth.log bantime = 900 banaction = iptables-allports findtime = 900 maxretry = 3 My dropbear.conf fail2ban filter
[Definition] _daemon = dropbear # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "<HOST>" can # be used for standard IP/hostname matching and is only an alias for # (?:::f{4,6}:)?(?P<host>\S+) # Values: TEXT # These match the unmodified dropbear messages. It isn't possible to # match the source of the 'exit before auth' messages from dropbear. # failregex = ^%(__prefix_line)slogin attempt for nonexistent user ('.*' )?from <HOST>:.*\s*$ ^%(__prefix_line)sbad password attempt for .+ from <HOST>:.*\s*$ # The only line we need to match with the modified dropbear. # NOTE: The failregex below is ONLY intended to work with a patched # version of Dropbear as described here: # http://www.unchartedbackwaters.co.uk/pyblosxom/static/patches And the standard jail.config (these options should be overwrote with the .local jail)
# in /etc/fail2ban/jail.local. # # Optionally you may override any other parameter (e.g. banaction, # action, port, logpath, etc) in that section within jail.local [ssh] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log maxretry = 6 [dropbear] enabled = true port = ssh filter = sshd logpath = /var/log/dropbear maxretry = 6 
