2013-10-30 13:02:59 +00:00
# Fail2Ban filter for openssh
2006-07-17 19:26:14 +00:00
#
2014-02-02 04:16:40 +00:00
# If you want to protect OpenSSH from being bruteforced by password
# authentication then get public key authentication working before disabling
2014-02-13 05:20:36 +00:00
# PasswordAuthentication in sshd_config.
#
#
# "Connection from <HOST> port \d+" requires LogLevel VERBOSE in sshd_config
#
2006-07-17 19:26:14 +00:00
2007-09-12 21:38:51 +00:00
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
2008-03-04 00:17:56 +00:00
before = common.conf
2007-09-12 21:38:51 +00:00
2006-07-16 21:35:08 +00:00
[Definition]
2006-06-26 20:05:00 +00:00
2007-09-12 21:38:51 +00:00
_daemon = sshd
2016-03-16 17:52:01 +00:00
failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failed|failure|error) for .* from <HOST>( via \S+)?\s*$
2008-07-22 22:29:57 +00:00
^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
2013-11-08 18:06:24 +00:00
^%(__prefix_line)sFailed \S+ for .*? from <HOST>(?: port \d*)?(?: ssh\d*)?(: (ruser .*|(\S+ ID \S+ \(serial \d+\) CA )?\S+ %(__md5hex)s(, client user ".*", client host ".*")?))?\s*$
2007-09-12 21:38:51 +00:00
^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
2012-02-11 02:14:51 +00:00
^%(__prefix_line)sUser .+ from <HOST> not allowed because not listed in AllowUsers\s*$
2012-04-17 00:36:53 +00:00
^%(__prefix_line)sUser .+ from <HOST> not allowed because listed in DenyUsers\s*$
2013-04-16 14:03:36 +00:00
^%(__prefix_line)sUser .+ from <HOST> not allowed because not in any group\s*$
2008-03-04 22:41:28 +00:00
^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
2015-10-02 22:19:42 +00:00
^%(__prefix_line)s(?:error: )?Received disconnect from <HOST>: 3: .*: Auth fail(?: \[preauth\])?$
2013-04-16 14:03:36 +00:00
^%(__prefix_line)sUser .+ from <HOST> not allowed because a group is listed in DenyGroups\s*$
2011-11-18 15:07:13 +00:00
^%(__prefix_line)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$
2014-04-27 12:35:55 +00:00
^(?P<__prefix>%(__prefix_line)s)User .+ not allowed because account is locked<SKIPLINES>(?P=__prefix)(?:error: )?Received disconnect from <HOST>: 11: .+ \[preauth\]$
2013-11-25 03:55:41 +00:00
^(?P<__prefix>%(__prefix_line)s)Disconnecting: Too many authentication failures for .+? \[preauth\]<SKIPLINES>(?P=__prefix)(?:error: )?Connection closed by <HOST> \[preauth\]$
2014-05-20 03:47:16 +00:00
^(?P<__prefix>%(__prefix_line)s)Connection from <HOST> port \d+(?: on \S+ port \d+)?<SKIPLINES>(?P=__prefix)Disconnecting: Too many authentication failures for .+? \[preauth\]$
2015-12-14 04:21:04 +00:00
^%(__prefix_line)s(error: )?maximum authentication attempts exceeded for .* from <HOST>(?: port \d*)?(?: ssh\d*)? \[preauth\]$
2015-04-17 08:22:01 +00:00
^%(__prefix_line)spam_unix\(sshd:auth\):\s+authentication failure;\s*logname=\S*\s*uid=\d*\s*euid=\d*\s*tty=\S*\s*ruser=\S*\s*rhost=<HOST>\s.*$
2006-06-26 20:05:00 +00:00
2006-11-15 18:44:28 +00:00
ignoreregex =
2013-05-27 21:06:49 +00:00
[Init]
# "maxlines" is number of log lines to buffer for multi-line regex searches
maxlines = 10
2013-06-29 12:00:40 +00:00
2013-05-09 23:15:07 +00:00
journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=sshd
2013-11-02 04:59:05 +00:00
2013-11-08 22:34:31 +00:00
# DEV Notes:
#
# "Failed \S+ for .*? from <HOST>..." failregex uses non-greedy catch-all because
# it is coming before use of <HOST> which is not hard-anchored at the end as well,
# and later catch-all's could contain user-provided input, which need to be greedily
# matched away first.
#
2013-10-30 13:02:59 +00:00
# Author: Cyril Jaquier, Yaroslav Halchenko, Petr Voralek, Daniel Black
2013-11-02 04:59:05 +00:00
