Fail2ban is not working for sshd with systemd backend

Help
1

Hello

I am quite new to nixos, so I might miss something, but it seems that fail2ban for sshd is not working with the systemd backend.

The configuration

  services.fail2ban = {
    enable = true;
    maxretry = 3;
    bantime = "1h";
    jails = {
      sshd.settings = {
	backend = "systemd";
	mode = "aggressive";
      };
    };
  };

  services = {
    openssh = {
      ports = [ 54321 ];
      settings = {
        PasswordAuthentication = false;
	    X11Forwarding = true;
        PermitRootLogin = "no";
      };
    };
    sshd = {
      enable = true;
    };
  };

When I try 5 times with invalid public key I get penalized by the ssdh daemon for a couple of minutes but normally after 3 attempts fail2ban should kick in which it does not.

I see these logs 5 times in journal:

Jul 12 22:26:53 host sshd-session[1474587]: error: PAM: Authentication failure for root from x.x.x.
Jul 12 22:26:53 host sshd-session[1474587]: Failed keyboard-interactive/pam for root from x.x.x.x port 20626 ssh2
Jul 12 22:26:53 host sshd-session[1474587]: Connection closed by authenticating user root x.x.x.x port 20626 [preauth]
Jul 12 22:26:53 host sshd[1462738]: srclimit_penalise: ipv4: new x.x.x.x/32 deferred penalty of 5 seconds for penalty: failed authentication
Jul 12 22:27:02 host sshd-session[1474625]: Connection from x.x.x.x port 17694 on 192.168.x.x port 54321 rdomain ""
Jul 12 22:27:02 host sshd-session[1474625]: Failed publickey for root from x.x.x.x port 17694 ssh2

When checking my debian system (where fail2ban works with same config) the logs are completely different for example:

Jul 12 22:33:38 host sshd[3424024]: ROOT LOGIN REFUSED FROM x.x.x.x port 19296
Jul 12 22:33:38 host sshd[3424024]: ROOT LOGIN REFUSED FROM x.x.x.x port 19296 [preauth]
Jul 12 22:33:38 host sshd[3424024]: Connection closed by authenticating user root x.x.x.x port 19296 [preauth]

So I assume it has to do with the fact that fail2ban does not understand nixos sshd journal logs?

I think it has something todo with how fai2ban picks up the logs it does matching based on _SYSTEMD_UNIT=sshd.service + _COMM=sshd where COMM means the service, and with nixos the service is sshd-session which is odd?

Thanks!

2

I just hit this on my system. It’s not a NixOS issue, the OpenSSH 9.8 upgrade broke fail2ban’s regexes:

3

Here’s a temporary fix:

  services.fail2ban.package = pkgs.fail2ban.overrideAttrs(old: {
    patches = [
      (pkgs.fetchpatch {
        url = "https://github.com/fail2ban/fail2ban/commit/2fed408c05ac5206b490368d94599869bd6a056d.patch";
        hash = "sha256-uyrCdcBm0QyA97IpHzuGfiQbSSvhGH6YaQluG5jVIiI=";
      })
      (pkgs.fetchpatch {
        url = "https://github.com/fail2ban/fail2ban/commit/50ff131a0fd8f54fdeb14b48353f842ee8ae8c1a.patch";
        hash = "sha256-YGsUPfQRRDVqhBl7LogEfY0JqpLNkwPjihWIjfGdtnQ=";
      })
    ];
  });
4

Hello @vs49688 thanks for your reply, this did the trick! (I did not not know you could do this kind of ‘overlays’ so I learned something new as well thanks!)

Greetings

1 Like