A lot of folks use fail2ban, not just as a way of quashing brute force attacks on their infrastructure but also to keep the enormous logs that such attacks create in check. I was securing some boxes at $DAYJOB for a proof of concept rollout and ran into an interesting failure mode wherein fail2ban lives up to its name.
So there I was in Ubuntu-land, bolting things down. Secured sshd to not allow password (keys only). Then I install fail2ban. Just to be sure the right thing was happening I tried to log in multiple times with no key to see if I got banned.
Funny. Nothing happened. Looked in the logs. Saw a bunch of auth.log lines of the form:
Mar 12 17:18:01 stream1-Dell710 sshd: Connection closed by 10.14.0.47 [preauth]
Interesting. That’s not a login failure, just a protocol capabilities mismatch. So fail2ban… fails to ban.
No, there wasn’t any risk of actual break-in, but an attempted brute force attack can still fill up your logs.