The record source is set by the backend parameter.
backend = systemd means: read the journald journal, the same one journalctl shows. The file variant is backend with the logpath parameter, a path to a text log such as /var/log/auth.log. The journald journal is shared by all services, so a jail is narrowed with the journalmatch line: it says which unit to take records from, such as _SYSTEMD_UNIT=ssh.service. Point it at a service that does not exist or is not under attack, and the jail reads emptiness and counts no attempts. That is what you saw: the brute force was on lab-sshd, while the jail watched sshd.service.
The jail has backend = systemd. Where does fail2ban take the failed-login records from?
-
fail2ban-clientonly shows the jails' state. The service takes records from the source set bybackend. -
A file is read by the other variant —
backendwithlogpath. Withbackend = systemdfail2ban takes records from the journald journal, not from a file.
backend = systemd tells fail2ban to read the journald journal. Which unit to take from the journal is narrowed by journalmatch. A file source is backend with logpath, a path to a text log.
Key points
-
backend = systemd— fail2ban reads the journald journal; the file variant isbackendwithlogpath. -
journalmatchnarrows the journal to the right unit (_SYSTEMD_UNIT=…). - A jail aimed at the wrong service reads emptiness and bans nobody.