Multiple filters in fail2ban jail?

[evonet]

Search did not produce answer. I know a jail can have multiple actions and logs, but I don’t know if it can have multiple filters:

[jailname]
enabled  = true
filter   = filtername
action   = actionname0
           actionname1
logpath  = logpathfile0
           logpathfile1

If no one knows, I’m not sure how to test. Any thoughts on setting up a test?

Thanks!

[sahsanu]

AFAIK it is not possible to use two filters in same jail conf.

Example using two filters that exist:

[jailname]
enabled  = true
filter   = exim
           dovecot
action   = actionname0
           actionname1
logpath  = logpathfile0
           logpathfile1

$ fail2ban-client -vvd 2>&1 | grep filter | tail -n3
 2023-10-28 11:09:49,729 7F4+49149C040 ERROR Found no accessible config files for 'filter.d/exim\ndovecot' under /etc/fail2ban
 2023-10-28 11:09:49,729 7F449149C040 ERROR Unable to read the filter 'exim\ndovecot'
['config-error', "Jail 'jailname' skipped, because of wrong configuration: Unable to read the filter 'exim\\ndovecot'"]

If you want to use two filters you should merge both in only one and use that filter in your jail.

[evonet]

Thanks @sahsanu ! And for showing how to test it!