Skip to content

main/fail2ban: change filter pattern from `sshd` to `sshd-session`

Package Information

  • Package name: fail2ban
  • Package version: 1.1.0
  • Alpine version: 3.21.0_alpha20240606
  • Alpine architecture: x86_64

Summary

After openssh upgrade to v9.8, the daemon name changed to sshd-session.

Example:

Jul 13 11:14:04 ci auth.info sshd-session[10385]: Failed password for root from 10.233.4.10 port 54226 ssh2
Jul 13 11:14:04 ci auth.info sshd-session[10385]: Failed password for root from 10.233.4.10 port 54226 ssh2
Jul 13 11:14:04 ci auth.err sshd-session[10385]: error: maximum authentication attempts exceeded for root from 10.233.4.10 port 54226 ssh2 [preauth]
Jul 13 11:14:04 ci auth.info sshd-session[10385]: Disconnecting authenticating user root 10.233.4.10 port 54226: Too many authentication failures [preauth]

Original fail2ban filter patterns didn't work anymore.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information