github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

SSHd add Bad protocol version message

pull/2404/head
benrubson 2019-05-02 11:42:45 +02:00
parent 1752c19b6f
commit 5b2b680bfe
2 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
config/filter.d/sshd.conf
View File

@ -64,6 +64,7 @@ mdre-normal =
mdrp-normal-suff-onclosed = (?:%(__suff)s|\s*)$
mdre-ddos = ^Did not receive identification string from <HOST>
^Bad protocol version identification '.*' from <HOST>
^Connection <F-MLFFORGET>reset</F-MLFFORGET> by <HOST>
^Connection <F-MLFFORGET>closed</F-MLFFORGET> by%(__authng_user)s <HOST>%(__on_port_opt)s\s+\[preauth\]\s*$
^<F-NOFAIL>SSH: Server;Ltype:</F-NOFAIL> (?:Authname|Version|Kex);Remote: <HOST>-\d+;[A-Z]\w+:

2
fail2ban/tests/files/logs/sshd
View File

@ -260,6 +260,8 @@ Mar 7 18:53:38 bar sshd[1559]: Connection closed by 192.0.2.116
Jun 7 01:10:56 host sshd[5937]: Did not receive identification string from 69.61.56.114
# failJSON: { "time": "2005-06-07T01:11:57", "match": true , "host": "192.0.2.5", "desc": "refactored message (with port now, gh-2062)" }
Jun 7 01:11:57 host sshd[8782]: Did not receive identification string from 192.0.2.5 port 35836
# failJSON: { "time": "2005-06-07T01:11:58", "match": true , "host": "69.61.56.115" }
Jun 7 01:11:58 host sshd[8783]: Bad protocol version identification 'dummy string' from 69.61.56.115 port 31778
# gh-864(1):
# failJSON: { "match": false }