#888711 fail2ban fails to start sshd-ddos filter.

Package:
fail2ban
Source:
fail2ban
Submitter:
Peter Chubb
Date:
2026-09-07 15:37:07 UTC
Severity:
normal
#888711#5
Date:
2018-01-29 01:54:37 UTC
From:
To:
Dear Maintainer,

After upgrading fail2ban, it no longer starts.
The error message is:

fail2ban Failed during configuration: Bad value substitution:
option 'mode' in section 'Definition' contains an interpolation
 key 'ddos' which is not a valid option name. Raw value: '%(ddos)s'

The problem is in /etc/fail2ban/filter.d/sshd-ddos.conf
#888711#10
Date:
2018-01-29 02:07:36 UTC
From:
To:
Idézem/Quoting Peter Chubb <peter.chubb@data61.csiro.au>:

It seems to be that the sshd-ddos filter has been merged into sshd.
Please see sshd.conf for details and remove sshd-ddos.conf and set

[sshd]
mode = ddos.

I hope this helps you.


SZÉPE Viktor, honlap üzemeltetés
https://github.com/szepeviktor/debian-server-tools/blob/master/CV.md
#888711#15
Date:
2018-01-29 02:24:48 UTC
From:
To:
SZÉPE> Idézem/Quoting Peter Chubb <peter.chubb@data61.csiro.au>:

SZÉPE> It seems to be that the sshd-ddos filter has been merged into
SZÉPE> sshd.  Please see sshd.conf for details and remove
SZÉPE> sshd-ddos.conf and set

SZÉPE> [sshd] mode = ddos.

SZÉPE> I hope this helps you.

Doing that gets me going -- thanks.

However, it seems to me that the Debian config files
are set up to allow multiple jail names, and it should be possible to
do

[sshd-ddos]
enabled = true


in jail.local and it should work (like it used to).

The same goes for sshd-aggressive.

Maybe sshd-ddos.conf should be rewritten as:

...
[Definition]
filter=sshd[mode=ddos]
...

Alternatively, remove sshd-ddos.conf and sshd-aggressive.conf from the
package

Peter C
#888711#20
Date:
2018-01-29 14:58:51 UTC
From:
To:
they aren't shipped with 0.10 version of the package -- they are left
	from previous versions:

	$> wget http://ftp.us.debian.org/debian/pool/main/f/fail2ban/fail2ban_0.10.2-1_all.deb
    ...

	$> dpkg -c fail2ban_0.10.2-1_all.deb| grep sshd
	-rw-r--r-- root/root      5318 2018-01-18 08:49 ./etc/fail2ban/filter.d/sshd.conf
	-rw-r--r-- root/root      5323 2018-01-22 10:38 ./usr/lib/python3/dist-packages/fail2ban/tests/config/filter.d/zzz-sshd-obsolete-multiline.conf
	-rw-r--r-- root/root     23147 2018-01-18 08:49 ./usr/lib/python3/dist-packages/fail2ban/tests/files/logs/sshd
	-rw-r--r-- root/root        36 2018-01-18 08:49 ./usr/lib/python3/dist-packages/fail2ban/tests/files/logs/zzz-sshd-obsolete-multiline
	-rw-r--r-- root/root       362 2018-01-18 08:49 ./usr/lib/python3/dist-packages/fail2ban/tests/files/zzz-sshd-obsolete-multiline.log

note that NEWS and changelog pointed out that there are changes to
config etc:

	$> zcat /usr/share/doc/fail2ban/NEWS.Debian.gz | head -n 20
	fail2ban (0.10.2-1) unstable; urgency=medium

	  This version is a major development leap forward to provide
	  IPv6 support, which also required extensions to the configuration
	  system.  That is why it is not unlikely that configuration left from the
	  previous version(s) would either not work or would not work as intended.

	  You are advised to accept new configuration and adjust it for your
	  customizations (if any).
#888711#25
Date:
2019-07-19 09:50:35 UTC
From:
To:
Dear Maintainer,

fail2ban 0.10.2-2.1 still ships the incorrect sshd-ddos.conf and
sshd-aggressive.conf files. Neither ddos nor aggressive are defined
parameters so these files should be rewritten as shown in the
attachements, that is by simply setting mode to the desired value:

mode = ddos

and

mode = aggressive

respectively.