#1005923 Fail2ban ignores some SSH logs

Package:
fail2ban
Source:
fail2ban
Submitter:
Grzegorz Janoszka
Date:
2022-02-17 12:12:03 UTC
Severity:
normal
#1005923#5
Date:
2022-02-17 10:56:12 UTC
From:
To:
When I set in jail.local in [ssh] section: mode = extra (or aggressive)
then fail2ban still ignores the following lines in authlog:

sshd[458759]: Unable to negotiate with 165.232.112.163 port 47994: no
matching key exchange method found. Their offer:
diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
[preauth]

The command fail2ban-regex /var/log/auth.log
/etc/fail2ban/filter.d/sshd.conf --print-all-missed confirms that such
lines are missed.

There is a regexp to much similar logs in the default sshd filter, but
obviously it is broken.

I have Debian 11.2 with all latest updates.
#1005923#10
Date:
2022-02-17 11:59:47 UTC
From:
To:
It might have been my typo. I have been working on it for so many
days... and probably a typo.

Please close the bug, sorry for bothering you.