Proxmox 8 Login : Fail2Ban not working

[hendr1x]

Hello everyone,
I followed this guide : https://pve.proxmox.com/wiki/Fail2ban

Then implemented all the attempts @ https://forum.proxmox.com/threads/pve-8-0-–-fail2ban-log-locations-missing.129338/

When I manually trigger the maxretrys nothing happens. When I run the test code provided

fail2ban-regex /var/log/daemon.log /etc/fail2ban/filter.d/proxmox.conf

I get an error because /var/log/daemon.log does not exist.

Any suggestions?

 

[lbdonato]

Any solution? i have same problem.

 

[hendr1x]

Any solution? i have same problem.

I gave up and decided the best approach was to block access to the form via firewall.

 

[bbgeek17]

I recommend using search function of the forum. Entering "fail2ban" should yield informative threads in the first 10-20 results (discounting those in German if you are not familiar with the language).
I.e. https://forum.proxmox.com/threads/pve-8-0-–-fail2ban-log-locations-missing.129338/#post-576497

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox

 

[vinet]

i need the logs for my SIEM System, is there a posibility for other options to see logs with login status?

 

[Dunuin]

You could install rsyslog to get syslog logfiles again if your SIEM doesn't support systemd journal.
I was also looking to install Wuzah where it looks like it isn't supporting systemd journal drectly. So options there would be either install rsyslog again or let journald output the logs as json and pipe that into a file which you then let your SIEM analyse if it supports json logs (which in both bases results in unnecessary SSD wear as all logs then get written 3 times...).
Ideally I would like to only use systemd journal stored in RAM and let that Wuzah agent read that and collect them centralized in a DB.

 

[torusJKL]

The wiki seems not to be up to date.
For using fail2ban-regex with systemd as the backend use:

fail2ban-regex systemd-journal /etc/fail2ban/filter.d/proxmox.conf