mirror of https://github.com/fail2ban/fail2ban
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
139 lines
8.2 KiB
139 lines
8.2 KiB
# Fail2Ban filter for openssh |
|
# |
|
# If you want to protect OpenSSH from being bruteforced by password |
|
# authentication then get public key authentication working before disabling |
|
# PasswordAuthentication in sshd_config. |
|
# |
|
# |
|
# "Connection from <HOST> port \d+" requires LogLevel VERBOSE in sshd_config |
|
# |
|
|
|
[INCLUDES] |
|
|
|
# Read common prefixes. If any customizations available -- read them from |
|
# common.local |
|
before = common.conf |
|
|
|
[DEFAULT] |
|
|
|
_daemon = sshd(?:-session)? |
|
|
|
# optional prefix (logged from several ssh versions) like "error: ", "error: PAM: " or "fatal: " |
|
__pref = (?:(?:error|fatal): (?:PAM: )?)? |
|
# optional suffix (logged from several ssh versions) like " [preauth]" |
|
#__suff = (?: port \d+)?(?: \[preauth\])?\s* |
|
__suff = (?: (?:port \d+|on \S+|\[preauth\])){0,3}\s* |
|
__on_port_opt = (?: (?:port \d+|on \S+)){0,2} |
|
# close by authenticating user (don't use <HOST> after %(__authng_user)s because of catch-all `.*?`): |
|
__authng_user = (?: (?:by|from))?(?: (?:invalid|authenticating) user <F-USER>\S+|.*?</F-USER>)?(?: from)? |
|
|
|
# for all possible (also future) forms of "no matching (cipher|mac|MAC|compression method|key exchange method|host key type) found", |
|
# see ssherr.c for all possible SSH_ERR_..._ALG_MATCH errors. |
|
__alg_match = (?:(?:\w+ (?!found\b)){0,2}\w+) |
|
|
|
# PAM authentication mechanism, can be overridden, e. g. `filter = sshd[__pam_auth='pam_ldap']`: |
|
__pam_auth = pam_[a-z]+ |
|
|
|
[Definition] |
|
|
|
prefregex = ^<F-MLFID>%(__prefix_line)s</F-MLFID>%(__pref)s<F-CONTENT>.+</F-CONTENT>$ |
|
|
|
cmnfailre = ^[aA]uthentication (?:failure|error|failed) for <F-USER>.*?</F-USER> (?:from )?<HOST>( via \S+)?%(__suff)s$ |
|
^User not known to the underlying authentication module for <F-USER>.*?</F-USER> (?:from )?<HOST>%(__suff)s$ |
|
<cmnfailre-failed-pub-<publickey>> |
|
^Failed <cmnfailed> for (?P<cond_inv>invalid user )?<F-USER>(?P<cond_user>\S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+)</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$) |
|
^<F-USER>ROOT</F-USER> LOGIN REFUSED FROM <HOST> |
|
^[iI](?:llegal|nvalid) user <F-USER>.*?</F-USER> (?:from )?<HOST>%(__suff)s$ |
|
^User <F-USER>\S+|.*?</F-USER> (?:from )?<HOST> not allowed because not listed in AllowUsers%(__suff)s$ |
|
^User <F-USER>\S+|.*?</F-USER> (?:from )?<HOST> not allowed because listed in DenyUsers%(__suff)s$ |
|
^User <F-USER>\S+|.*?</F-USER> (?:from )?<HOST> not allowed because not in any group%(__suff)s$ |
|
^refused connect from \S+ \(<HOST>\) |
|
^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(__on_port_opt)s:\s*3: .*: Auth fail%(__suff)s$ |
|
^User <F-USER>\S+|.*?</F-USER> (?:from )?<HOST> not allowed because a group is listed in DenyGroups%(__suff)s$ |
|
^User <F-USER>\S+|.*?</F-USER> (?:from )?<HOST> not allowed because none of user's groups are listed in AllowGroups%(__suff)s$ |
|
^<F-NOFAIL>%(__pam_auth)s\(sshd:auth\):\s+authentication failure;</F-NOFAIL>(?:\s+(?:(?:logname|e?uid|tty)=\S*)){0,4}\s+ruser=<F-ALT_USER>\S*</F-ALT_USER>\s+rhost=<HOST>(?:\s+user=<F-USER>\S*</F-USER>)?%(__suff)s$ |
|
^maximum authentication attempts exceeded for (?:invalid user )?<F-USER>.*?</F-USER> (?:from )?<HOST>%(__on_port_opt)s(?: ssh\d*)?%(__suff)s$ |
|
^User <F-USER>\S+|.*?</F-USER> not allowed because account is locked%(__suff)s |
|
^<F-MLFFORGET>Disconnecting</F-MLFFORGET>(?: from)?(?: (?:invalid|authenticating)) user <F-USER>\S+</F-USER> <HOST>%(__on_port_opt)s:\s*Change of username or service not allowed:\s*.*\[preauth\]\s*$ |
|
^Disconnecting: Too many authentication failures(?: for <F-USER>\S+|.*?</F-USER>)?%(__suff)s$ |
|
^<F-NOFAIL>Received <F-MLFFORGET>disconnect</F-MLFFORGET></F-NOFAIL> from <HOST>%(__on_port_opt)s:\s*11: |
|
<mdre-<mode>-other> |
|
^<F-MLFFORGET><F-MLFGAINED>Accepted \w+</F-MLFGAINED></F-MLFFORGET> for <F-USER>\S+</F-USER> from <HOST>(?:\s|$) |
|
|
|
cmnfailed-any = \S+ |
|
cmnfailed-ignore = \b(?!publickey)\S+ |
|
cmnfailed-invalid = <cmnfailed-ignore> |
|
cmnfailed-nofail = (?:<F-NOFAIL>publickey</F-NOFAIL>|\S+) |
|
cmnfailed = <cmnfailed-<publickey>> |
|
|
|
mdre-normal = |
|
# used to differentiate "connection closed" with and without `[preauth]` (fail/nofail cases in ddos mode) |
|
mdre-normal-other = ^<F-NOFAIL><F-MLFFORGET>(?:Connection (?:closed|reset)|Disconnect(?:ed|ing))</F-MLFFORGET></F-NOFAIL>%(__authng_user)s <ADDR>%(__on_port_opt)s(?:: (?!Too many authentication failures)[^\[]+)?(?: \[preauth\])?\s*$ |
|
|
|
mdre-ddos = ^(?:Did not receive identification string from|Timeout before authentication for) <HOST> |
|
^kex_exchange_identification: (?:read: )?(?:[Cc]lient sent invalid protocol identifier|[Cc]onnection (?:closed by remote host|reset by peer)) |
|
^Bad protocol version identification '(?:[^']|.*?)' (?:from )?<HOST>%(__suff)s$ |
|
^<F-NOFAIL>SSH: Server;Ltype:</F-NOFAIL> (?:Authname|Version|Kex);Remote: <HOST>-\d+;[A-Z]\w+: |
|
^Read from socket failed: Connection <F-MLFFORGET>reset</F-MLFFORGET> by peer |
|
^(?:banner exchange|ssh_dispatch_run_fatal): Connection from <HOST><__on_port_opt>: (?:invalid format|(?:message authentication code incorrect|[Cc]onnection corrupted) \[preauth\]) |
|
|
|
# same as mdre-normal-other, but as failure (without <F-NOFAIL> with [preauth] and with <F-NOFAIL> on no preauth phase as helper to identify address): |
|
mdre-ddos-other = ^<F-MLFFORGET>(?:Connection (?:closed|reset)|Disconnect(?:ed|ing))</F-MLFFORGET>%(__authng_user)s <ADDR>%(__on_port_opt)s(?:: (?!Too many authentication failures)[^\[]+)?\s+\[preauth\]\s*$ |
|
^<F-NOFAIL><F-MLFFORGET>(?:Connection (?:closed|reset)|Disconnect(?:ed|ing))</F-MLFFORGET></F-NOFAIL>%(__authng_user)s <ADDR>(?:%(__on_port_opt)s(?:: (?!Too many authentication failures)[^\[]+)?|\s*)$ |
|
|
|
mdre-extra = ^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(__on_port_opt)s:\s*14: No(?: supported)? authentication methods available |
|
^Unable to negotiate with <HOST>%(__on_port_opt)s: no matching <__alg_match> found. |
|
^Unable to negotiate a <__alg_match> |
|
^no matching <__alg_match> found: |
|
# part of mdre-ddos-other, but user name is supplied (invalid/authenticating) on [preauth] phase only: |
|
mdre-extra-other = ^<F-MLFFORGET>Disconnected</F-MLFFORGET>(?: from)?(?: (?:invalid|authenticating)) user <F-USER>\S+|.*?</F-USER> (?:from )?<HOST>%(__on_port_opt)s \[preauth\]\s*$ |
|
|
|
mdre-aggressive = %(mdre-ddos)s |
|
%(mdre-extra)s |
|
# mdre-extra-other is fully included within mdre-ddos-other: |
|
mdre-aggressive-other = %(mdre-ddos-other)s |
|
|
|
# Parameter "publickey": nofail (default), invalid, any, ignore |
|
publickey = nofail |
|
# consider failed publickey for invalid users only: |
|
cmnfailre-failed-pub-invalid = ^Failed publickey for invalid user <F-USER>(?P<cond_user>\S+)|(?:(?! from ).)*?</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$) |
|
# consider failed publickey for valid users too (don't need RE, see cmnfailed): |
|
cmnfailre-failed-pub-any = |
|
# same as invalid, but consider failed publickey for valid users too, just as no failure (helper to get IP and user-name only, see cmnfailed): |
|
cmnfailre-failed-pub-nofail = <cmnfailre-failed-pub-invalid> |
|
# don't consider failed publickey as failures (don't need RE, see cmnfailed): |
|
cmnfailre-failed-pub-ignore = |
|
|
|
cfooterre = ^<F-NOFAIL>Connection from</F-NOFAIL> <HOST> |
|
|
|
failregex = %(cmnfailre)s |
|
<mdre-<mode>> |
|
%(cfooterre)s |
|
|
|
# Parameter "mode": normal (default), ddos, extra or aggressive (combines all) |
|
# Usage example (for jail.local): |
|
# [sshd] |
|
# mode = extra |
|
# # or another jail (rewrite filter parameters of jail): |
|
# [sshd-aggressive] |
|
# filter = sshd[mode=aggressive] |
|
# |
|
mode = normal |
|
|
|
#filter = sshd[mode=aggressive] |
|
|
|
ignoreregex = |
|
|
|
maxlines = 1 |
|
|
|
journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=sshd + _COMM=sshd-session |
|
|
|
# DEV Notes: |
|
# |
|
# "Failed \S+ for .*? from <HOST>..." failregex uses non-greedy catch-all because |
|
# it is coming before use of <HOST> which is not hard-anchored at the end as well, |
|
# and later catch-all's could contain user-provided input, which need to be greedily |
|
# matched away first. |
|
# |
|
# Author: Cyril Jaquier, Yaroslav Halchenko, Petr Voralek, Daniel Black and Sergey Brester aka sebres |
|
# Rewritten using prefregex (and introduced "mode" parameter) by Serg G. Brester.
|
|
|