github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity
fail2ban/testcases/files/logs/sshd

49 lines
3.6 KiB
Plaintext
Raw Normal View History

Adding log samples accumulated in Debian branch
2011-11-18 16:55:46 +00:00
#1
Jun 21 16:47:48 digital-mlhhyiqscv sshd[13709]: error: PAM: Authentication failure for myhlj1374 from 192.030.0.6
ENH: logs/sshd -- use example.com as the resolved hostname in sample log lines
2013-05-07 16:26:13 +00:00
May 29 20:56:52 imago sshd[28732]: error: PAM: Authentication failure for stefanor from example.com
Adding log samples accumulated in Debian branch
2011-11-18 16:55:46 +00:00
#2
Feb 25 14:34:10 belka sshd[31602]: Failed password for invalid user ROOT from 194.117.26.69 port 50273 ssh2
Feb 25 14:34:10 belka sshd[31602]: Failed password for invalid user ROOT from 194.117.26.70 port 12345
#3
Jan 5 01:31:41 www sshd[1643]: ROOT LOGIN REFUSED FROM 1.2.3.4
Jan 5 01:31:41 www sshd[1643]: ROOT LOGIN REFUSED FROM ::ffff:1.2.3.4
#4
Jul 20 14:42:11 localhost sshd[22708]: Invalid user ftp from 211.114.51.213
#5 new filter introduced after looking at 44087D8C.9090407@bluewin.ch
ENH: logs/sshd -- have ":" after [daemon] (other uses are uncommon) See https://github.com/fail2ban/fail2ban/issues/216\#issuecomment-17535577 for the analysis
2013-05-07 16:30:05 +00:00
# yoh: added ':' after [sshd] since the case without is not really common any more
Mar 3 00:17:22 [sshd]: User root from 211.188.220.49 not allowed because not listed in AllowUsers
ENH: logs/sshd -- use example.com as the resolved hostname in sample log lines
2013-05-07 16:26:13 +00:00
Feb 25 14:34:11 belka sshd[31607]: User root from example.com not allowed because not listed in AllowUsers
Adding log samples accumulated in Debian branch
2011-11-18 16:55:46 +00:00
#6 ew filter introduced thanks to report Guido Bozzetto <reportbug@G-B.it>
Nov 11 23:33:27 Server sshd[5174]: refused connect from _U2FsdGVkX19P3BCJmFBHhjLza8BcMH06WCUVwttMHpE=_@::ffff:218.249.210.161 (::ffff:218.249.210.161)
#7 added exclamation mark to BREAK-IN
minor: added a note on now "negative" log entries on "POSSIBLE BREAK-IN ATTEMPT"
2012-11-06 02:22:33 +00:00
# Now should be a negative since we decided not to catch those
Adding log samples accumulated in Debian branch
2011-11-18 16:55:46 +00:00
Oct 15 19:51:35 server sshd[7592]: Address 1.2.3.4 maps to 1234.bbbbbb.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT
Oct 15 19:51:35 server sshd[7592]: Address 1.2.3.4 maps to 1234.bbbbbb.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
ENH: catch failed ssh logins due to being listed in DenyUsers. Close gh-47 (Closes: #669063)
2012-04-17 00:36:53 +00:00
#8 DenyUsers https://github.com/fail2ban/fail2ban/issues/47
Apr 16 22:01:15 al-ribat sshd[5154]: User root from 46.45.128.3 not allowed because listed in DenyUsers
ENH: match possibly present "pam_unix(sshd:auth):" portion for sshd (Closes: #648020)
2012-07-31 19:53:41 +00:00
ENH: Removed unused log line removed #9 per https://github.com/fail2ban/fail2ban/pull/182#discussion_r4068885
2013-05-04 10:38:05 +00:00
#9 OpenSolaris patch - pull https://github.com/fail2ban/fail2ban/pull/182
ENH+TST: ssh failure messages for OpenSolaris and OS X
2013-04-29 20:24:56 +00:00
Mar 29 05:59:23 dusky sshd[20878]: [ID 800047 auth.info] Failed keyboard-interactive for <invalid username> from 205.186.180.55 port 42742 ssh2
Mar 29 05:20:09 dusky sshd[19558]: [ID 800047 auth.info] Failed keyboard-interactive for james from 205.186.180.30 port 54520 ssh2
ENH: Removed unused log line removed #9 per https://github.com/fail2ban/fail2ban/pull/182#discussion_r4068885
2013-05-04 10:38:05 +00:00
#10 OSX syslog error
ENH: logs/sshd -- use example.com as the resolved hostname in sample log lines
2013-05-07 16:26:13 +00:00
Apr 29 17:16:20 Jamess-iMac.local sshd[62312]: error: PAM: authentication error for james from example.com via 192.168.1.201
ENH+TST: ssh failure messages for OpenSolaris and OS X
2013-04-29 20:24:56 +00:00
Apr 29 20:11:08 Jamess-iMac.local sshd[63814]: [ID 800047 auth.info] Failed keyboard-interactive for <invalid username> from 205.186.180.35 port 42742 ssh2
Apr 29 20:12:08 Jamess-iMac.local sshd[63814]: [ID 800047 auth.info] Failed keyboard-interactive for james from 205.186.180.22 port 54520 ssh2
Apr 29 20:13:08 Jamess-iMac.local sshd[63814]: Failed keyboard-interactive for james from 205.186.180.42 port 54520 ssh2
Apr 29 20:14:08 Jamess-iMac.local sshd[63814]: Failed keyboard-interactive for <invalid username> from 205.186.180.44 port 42742 ssh2
Apr 30 01:42:12 Jamess-iMac.local sshd[2554]: Failed keyboard-interactive/pam for invalid user jamedds from 205.186.180.77 port 33723 ssh2
Apr 29 12:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication failure for james from 205.186.180.88 via 192.168.1.201
Apr 29 13:53:38 Jamess-iMac.local sshd[47831]: error: PAM: Authentication failure for james from 205.186.180.99 via 192.168.1.201
Apr 29 15:53:38 Jamess-iMac.local sshd[47831]: error: PAM: Authentication error for james from 205.186.180.100 via 192.168.1.201
Apr 29 16:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.101 via 192.168.1.201
Apr 29 17:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.102
ENH: logs/sshd -- use example.com as the resolved hostname in sample log lines
2013-05-07 16:26:13 +00:00
Apr 29 18:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.103