From fresh bookworm installation, In fail2ban, the sshd jail which is
enable by default won’t work without rsyslog installed. The fail2ban
service then fails to start.

Hi,

As Debian opted by systemd journal as the default logging mechanism for
bookworm, maybe a better option would be to change the default
configuration in '/etc/fail2ban/jail.conf' to select journal as the
logging source, i.e., instead of setting 'backend = auto', set 'backend
= systemd'.

Best regards,
José Gonçalves

FWIW it appears that this bug is essentially a duplicate of #770171:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770171

That seems like a sensible suggestion to me.

Can you confirm that the current default bookworm fail2ban config/regex
works with sshd with just this change (to 'backend' in
/etc/fail2ban/jail.conf)? Or are further adjustments required?

Regards,
Jeremy

Hi Jeremy,

Yes, I can confirm that fail2ban sshd jail works fine using the default
config and just changing the 'backend' to 'systemd'.

Best regards,
José Gonçalves

Thank you José,

I really appreciate you taking the time to confirm.

Hope you have a great day! :)

Regards,
Jeremy

As a follow up (in case anyone hits the same issue as me):

After setting 'backend = systemd' fail2ban refused to start!?

It turns out that when using 'backend = systemd', python3-systemd is a
hard requirement. It is a recommended package for fail2ban but I have
recommends disabled by default, so had to manually install it.

i wonder if a missing python3-systemd is the only reason for this bug:
fail2ban + sshd works fine with backend=auto for me, and i have recommends
installed.

So rather than changing the default 'backend', debian should just promote
python3-systemd to 'depends'.