diff --git a/config/fail2ban.conf.default b/config/fail2ban.conf.default
index 58d005ca..d6b5dd9d 100644
--- a/config/fail2ban.conf.default
+++ b/config/fail2ban.conf.default
@@ -301,4 +301,4 @@ timepattern = %%b %%d %%H:%%M:%%S
 # Notes.:  regex to match the password failures messages in the logfile.
 # Values:  TEXT  Default:  (?:Authentication failure|Failed (?:keyboard-interactive/pam|password)) for(?: illegal user)? .* from (?:::f{4,6}:)?(?P<host>\S*)
 #
-failregex = : (?:Authentication failure for |Failed [-/\w+]+ for )?(?:[iI]llegal user )?.* from (?:::f{4,6}:)?(?P<host>\S*)
+failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI]llegal user)?|Illegal user) .* from (?:::f{4,6}:)?(?P<host>\S*)