There's a closed pull request on the void-packages repository fail2ban: add filter for sshd with socklog https://github.com/void-linux/void-packages/pull/44977 Description: The sshd filter distributed with fail2ban does not work properly with socklog out of the box. Ideally, socklog would have comprehensive support upstream, but the configuration to make it work with *just* sshd is very straighforward and the fail2ban package should be able to protect sshd out of the box with void's preferred syslog implementation. This change doesn't override any of fail2ban's default configuration. It adds a new filter defined in `sshd-socklock.conf` which inherits from the default `sshd.conf` and overrides only what is needed to make it work. #### Testing the changes - I tested the changes in this PR: **YES**