[SOLVED] Missing "auth.log" in Proxmox VE 8.0 - fail2ban sshd

[AlexDev]

Is anybody know why in Proxmox VE 8.0 missing the file "/var/log/auth.log" ?
I try to configure fail2ban with sshd jail and fail2ban crashed after restart because "auth.log" file is missing.

Best regards,
Aleksandar Grigorov

 

[bbgeek17]

PVE8 is based on Debian12. Deb12 consolidated most logging functions to journal facility, available via journalctl. You will need to find a way to adapt your applications to work with journal based logging.
https://unix.stackexchange.com/questions/268357/how-to-configure-fail2ban-with-systemd-journal

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox

 

[AlexDev]

OK!
Actual way to make fail2ban work for sshd in Debian 12:

After installing fail2ban in "/etc/fail2ban/jail.d/" we must have file "defaults-debian.conf" with content:

[sshd]
enabled = true

Old way to make sshd jail config was when remove file "default.conf ot defaults-debian.conf" and create file sshd.conf with content:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 2
banaction = iptables-allports
bantime = 3600
ignoreip = 127.0.0.1/8 your_ip_address

The new way that work for me is with change "logpath":
From:

logpath = /var/log/auth.log

To:

logpath = journal

and add line:

backend = systemd

under "logpath = journal"


The whole configuration looks like this:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = journal
backend = systemd
maxretry = 2
banaction = iptables-allports
bantime = 3600
ignoreip = 127.0.0.1/8 your_ip_address

Good luck to all!

 

[AlexDev]

Did you restart fail2ban after changes and check their status ?

 

[AlexDev]

I'm not sure that you read all. Maybe it's not the best way, but I personally separate jails in different files in "jail.d" folder. Read again that way I write and do it step by step. In my case, this is Debian 12 from the official Proxmox iso. After completing all the steps I described above, restart fail2ban. I recommend you to set "bantime =" to 180seconds "bantime = 180" for testing. If your IP is in "ignoreip =" you can not ban yourself.

 

[kamzata]

I'm not sure that you read all. Maybe it's not the best way, but I personally separate jails in different files in "jail.d" folder. Read again that way I write and do it step by step. In my case, this is Debian 12 from the official Proxmox iso. After completing all the steps I described above, restart fail2ban. I recommend you to set "bantime =" to 180seconds "bantime = 180" for testing. If your IP is in "ignoreip =" you can not ban yourself.

So, even this configuration is no more valid?

 

[AlexDev]

I will check this at the end of the week and report the result back here.

 

[keeka]

So, even this configuration is no more valid?

I believe when backend=journal, logpath is redundant.
Regardless of whether this is set globally in jail.conf or in the bundled jail definitions, you can override it for individual jails. So, if ssh is not being logged to a file, you could set backend=journal for the sshd jail.
Also, the .local configuration overlay applies throughout. So you don't need to modify any package files. Just create all your customisations in .local files be that jail.local, filters, actions etc.