A successful login subsequently emits this log entry:
Dec 20 17:53:36 REDACTED sshd[1281]: Accepted password for REDACTED from 
REDACTED port 40684 ssh2

A failed (password) login attempt however adds this log entry:
Dec 20 18:18:24 REDACTED sshd[1393]: pam_ldap: error trying to bind as user 
"uid=REDACTED,ou=people,dc=REDACTED,dc=REDACTED" (Invalid credentials)

In the LDAP+PAM case, fail2ban is now triggering on an entry added by upstream 
in April 2015:
"Added line to match sshd auth errors on OpenSuSE systems"
https://github.com/fail2ban/fail2ban/commit/8825a5f31b984fe52f705df6cec4720c9c1f0beb

Perhaps the proper solution would be to create a multi-line match here,
that only triggers if the same IP and hostname does not have a
subsequent 'Accepted password' entry?

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1609666

Title:
  fail2ban is too severe when pam_unix + pam_ldap are used together

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/fail2ban/+bug/1609666/+subscriptions

-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to