title: fail2ban not banning ssh bruteforce but regex works
body: <p>I've just noticed an ssh bruteforce at my server, which actually should have been banned by fail2ban, but for some reason it doesn't ban it. Most people who have problems with fail2ban, seem to have problems with their regex, which seems to be fine here. </p>
  
  <p>part of <strong>jail.conf</strong></p>
  
  <pre><code>[ssh]
  enabled  = true
  port     = ssh
  filter   = sshd
  logpath  = /var/log/auth.log
  maxretry = 6
  findtime = 6000
  bantime = 86400
  </code></pre>
  
  <p><strong>fail2ban-client status ssh</strong></p>
  
  <pre><code>Status for the jail: ssh
  |- filter
  |  |- File list:    /var/log/auth.log 
  |  |- Currently failed: 0
  |  `- Total failed: 0
  `- action
     |- Currently banned: 0
     |  `- IP list:   
     `- Total banned: 0
  </code></pre>
  
  <p><strong>fail2ban-regex  /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf</strong></p>
  
  <pre><code>Running tests
  =============
  
  Use regex file : /etc/fail2ban/filter.d/sshd.conf
  Use log file   : /var/log/auth.log
  
  
  Results
  =======
  
  Failregex
  |- Regular expressions:
  |  [1] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
  +\))?[\]\)]?:?(?:\[\d+\])?:)?\s*(?:error: PAM: )?Authentication failure for .* from &lt;HOST&gt;\s*$
  |  [2] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
  +\))?[\]\)]?:?(?:\[\d+\])?:)?\s*(?:error: PAM: )?User not known to the underlying authentication module for .* from &lt;HOST&gt;\s*$
  |  [3] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
  +\))?[\]\)]?:?(?:\[\d+\])?:)?\s*Failed (?:password|publickey) for .* from &lt;HOST&gt;(?: port \d*)?(?: ssh\d*)?$
  |  [4] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
  +\))?[\]\)]?:?(?:\[\d+\])?:)?\s*ROOT LOGIN REFUSED.* FROM &lt;HOST&gt;\s*$
  |  [5] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
  +\))?[\]\)]?:?(?:\[\d+\])?:)?\s*[iI](?:llegal|nvalid) user .* from &lt;HOST&gt;\s*$
  |  [6] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
  +\))?[\]\)]?:?(?:\[\d+\])?:)?\s*User .+ from &lt;HOST&gt; not allowed because not listed in AllowUsers$
  |  [7] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
  +\))?[\]\)]?:?(?:\[\d+\])?:)?\s*authentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=&lt;HOST&gt;(?:\s+user=.*)?\s*$
  |  [8] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
  +\))?[\]\)]?:?(?:\[\d+\])?:)?\s*refused connect from \S+ \(&lt;HOST&gt;\)\s*$
  |  [9] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
  +\))?[\]\)]?:?(?:\[\d+\])?:)?\s*Address &lt;HOST&gt; .* POSSIBLE BREAK-IN ATTEMPT!*\s*$
  |  [10] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\
  S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*User .+ from &lt;HOST&gt; not allowed because none of user's groups are listed in AllowGroups\s*$
  |
  `- Number of matches:
     [1] 0 match(es)
     [2] 0 match(es)
     [3] 380 match(es)
     [4] 0 match(es)
     [5] 353 match(es)
     [6] 26 match(es)
     [7] 0 match(es)
     [8] 0 match(es)
     [9] 0 match(es)
     [10] 0 match(es)
  
  Ignoreregex
  |- Regular expressions:
  |
  `- Number of matches:
  
  Summary
  =======
  
  Addresses found:
  [1]
  [2]
  [3]
      198.245.50.151 (Sat Dec 21 15:18:12 2013)
      198.245.50.151 (Sat Dec 21 15:18:15 2013)
      198.245.50.151 (Sat Dec 21 15:18:18 2013)
      198.245.50.151 (Sat Dec 21 15:18:21 2013)
      198.245.50.151 (Sat Dec 21 15:18:24 2013)
  ..................
  Date template hits:
  23379 hit(s): MONTH Day Hour:Minute:Second
  0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second Year
  ..................
  
  Success, the total number of match is 759
  </code></pre>
  
  <p>Any ideas, why fail2ban does not ban, even if I have lots of regex matches?</p>
  
  <p>Regards,
  fish</p>