diff --git a/cockpit/cockpit-installer.sh b/cockpit/cockpit-installer.sh
index 81a9d31..37d08ae 100644
--- a/cockpit/cockpit-installer.sh
+++ b/cockpit/cockpit-installer.sh
@@ -172,7 +172,7 @@ EOF
 cat > /etc/fail2ban/filter.d/cockpit.conf <<EOF
 [Definition]
 failregex = ^.*cockpit.*authentication failure.*rhost=<HOST>.*$
-            ^.*pam_unix.*cockpit.*authentication failure.*$
+            ^.*pam_unix.*cockpit.*authentication failure.*rhost=<HOST>.*$
 ignoreregex =
 maxlines = 1
 allowipv6 = auto