Public bug reported:
This is my hostname: 20073.s.serverhost.name
In /var/log/auth.log typical line looks like that:
Aug 15 21:44:42 20073 sshd[1230]: Received disconnect from 127.0.0.1: 11:
[preauth]
fail2ban service recognizes hostname like a part of date, so in
/var/log/fail2ban.log (when loglevel=DEBUG) we got:
<...>
2016-08-15 21:44:42,235 fail2ban.datedetector [1116]: DEBUG Matched time
template (?:DAY )?MON Day 24hour:Minute:Second(?:\.Microseconds)?(?: Year)?
2016-08-15 21:44:42,235 fail2ban.datedetector [1116]: DEBUG Got time
1187203482.000000 for "'Aug 15 21:44:42 2007'" using template (?:DAY )?MON Day
24hour:Minute:Second(?:\.Microseconds)?(?: Year)?
For this reason fail2ban doesn't ban attackers (it concerns at least for
sshd rules and other services, which log in /var/log/auth.log)
** Affects: fail2ban (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1613407
Title:
fail2ban service doesn't work correctly when hostname starts with
number
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/fail2ban/+bug/1613407/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
