I'm trying to get Fail2Ban to block failed sudo -i commands, but the IP is not showing up in the logs. For example when I log into the server with:
ssh -i ~/.ssh/id_rsa USER@1.2.3.4
I then use:
sudo -i
to get to root. When I check the log I then find this in /var/log/secure:
May 26 06:42:35 HOSTNAME sudo: pam_unix(sudo-i:auth): authentication failure; logname=USER uid=1320 euid=0 tty=/dev/pts/1 ruser=USER rhost= user=USER
As you can see there is no IP next to:
rhost=
I'm pretty sure if the IP was there it should be triggering this Fail2Ban rule in /etc/fail2ban/filter.d/sshd.conf:
^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
Any insights on this would be greatly appreciated.
