mirror of https://github.com/fail2ban/fail2ban
106 lines
8.5 KiB
Plaintext
106 lines
8.5 KiB
Plaintext
#1
|
|
# failJSON: { "time": "2005-06-21T16:47:48", "match": true , "host": "192.030.0.6" }
|
|
Jun 21 16:47:48 digital-mlhhyiqscv sshd[13709]: error: PAM: Authentication failure for myhlj1374 from 192.030.0.6
|
|
# failJSON: { "time": "2005-05-29T20:56:52", "match": true , "host": "example.com" }
|
|
May 29 20:56:52 imago sshd[28732]: error: PAM: Authentication failure for stefanor from example.com
|
|
|
|
#2
|
|
# failJSON: { "time": "2005-02-25T14:34:10", "match": true , "host": "194.117.26.69" }
|
|
Feb 25 14:34:10 belka sshd[31602]: Failed password for invalid user ROOT from 194.117.26.69 port 50273 ssh2
|
|
# failJSON: { "time": "2005-02-25T14:34:10", "match": true , "host": "194.117.26.70" }
|
|
Feb 25 14:34:10 belka sshd[31602]: Failed password for invalid user ROOT from 194.117.26.70 port 12345
|
|
|
|
#3
|
|
# failJSON: { "time": "2005-01-05T01:31:41", "match": true , "host": "1.2.3.4" }
|
|
Jan 5 01:31:41 www sshd[1643]: ROOT LOGIN REFUSED FROM 1.2.3.4
|
|
# failJSON: { "time": "2005-01-05T01:31:41", "match": true , "host": "1.2.3.4" }
|
|
Jan 5 01:31:41 www sshd[1643]: ROOT LOGIN REFUSED FROM ::ffff:1.2.3.4
|
|
|
|
#4
|
|
# failJSON: { "time": "2005-07-20T14:42:11", "match": true , "host": "211.114.51.213" }
|
|
Jul 20 14:42:11 localhost sshd[22708]: Invalid user ftp from 211.114.51.213
|
|
|
|
#5 new filter introduced after looking at 44087D8C.9090407@bluewin.ch
|
|
# yoh: added ':' after [sshd] since the case without is not really common any more
|
|
# failJSON: { "time": "2005-03-03T00:17:22", "match": true , "host": "211.188.220.49" }
|
|
Mar 3 00:17:22 [sshd]: User root from 211.188.220.49 not allowed because not listed in AllowUsers
|
|
# failJSON: { "time": "2005-02-25T14:34:11", "match": true , "host": "example.com" }
|
|
Feb 25 14:34:11 belka sshd[31607]: User root from example.com not allowed because not listed in AllowUsers
|
|
|
|
#6 ew filter introduced thanks to report Guido Bozzetto <reportbug@G-B.it>
|
|
# failJSON: { "time": "2004-11-11T23:33:27", "match": true , "host": "218.249.210.161" }
|
|
Nov 11 23:33:27 Server sshd[5174]: refused connect from _U2FsdGVkX19P3BCJmFBHhjLza8BcMH06WCUVwttMHpE=_@::ffff:218.249.210.161 (::ffff:218.249.210.161)
|
|
|
|
#7 added exclamation mark to BREAK-IN
|
|
# Now should be a negative since we decided not to catch those
|
|
# failJSON: { "match": false }
|
|
Oct 15 19:51:35 server sshd[7592]: Address 1.2.3.4 maps to 1234.bbbbbb.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT
|
|
# failJSON: { "match": false }
|
|
Oct 15 19:51:35 server sshd[7592]: Address 1.2.3.4 maps to 1234.bbbbbb.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
|
|
|
|
#8 DenyUsers https://github.com/fail2ban/fail2ban/issues/47
|
|
# failJSON: { "time": "2005-04-16T22:01:15", "match": true , "host": "46.45.128.3" }
|
|
Apr 16 22:01:15 al-ribat sshd[5154]: User root from 46.45.128.3 not allowed because listed in DenyUsers
|
|
|
|
#9 OpenSolaris patch - pull https://github.com/fail2ban/fail2ban/pull/182
|
|
# failJSON: { "time": "2005-03-29T05:59:23", "match": true , "host": "205.186.180.55" }
|
|
Mar 29 05:59:23 dusky sshd[20878]: [ID 800047 auth.info] Failed keyboard-interactive for <invalid username> from 205.186.180.55 port 42742 ssh2
|
|
# failJSON: { "time": "2005-03-29T05:20:09", "match": true , "host": "205.186.180.30" }
|
|
Mar 29 05:20:09 dusky sshd[19558]: [ID 800047 auth.info] Failed keyboard-interactive for james from 205.186.180.30 port 54520 ssh2
|
|
|
|
#10 OSX syslog error
|
|
# failJSON: { "time": "2005-04-29T17:16:20", "match": true , "host": "example.com" }
|
|
Apr 29 17:16:20 Jamess-iMac.local sshd[62312]: error: PAM: authentication error for james from example.com via 192.168.1.201
|
|
# failJSON: { "time": "2005-04-29T20:11:08", "match": true , "host": "205.186.180.35" }
|
|
Apr 29 20:11:08 Jamess-iMac.local sshd[63814]: [ID 800047 auth.info] Failed keyboard-interactive for <invalid username> from 205.186.180.35 port 42742 ssh2
|
|
# failJSON: { "time": "2005-04-29T20:12:08", "match": true , "host": "205.186.180.22" }
|
|
Apr 29 20:12:08 Jamess-iMac.local sshd[63814]: [ID 800047 auth.info] Failed keyboard-interactive for james from 205.186.180.22 port 54520 ssh2
|
|
# failJSON: { "time": "2005-04-29T20:13:08", "match": true , "host": "205.186.180.42" }
|
|
Apr 29 20:13:08 Jamess-iMac.local sshd[63814]: Failed keyboard-interactive for james from 205.186.180.42 port 54520 ssh2
|
|
# failJSON: { "time": "2005-04-29T20:14:08", "match": true , "host": "205.186.180.44" }
|
|
Apr 29 20:14:08 Jamess-iMac.local sshd[63814]: Failed keyboard-interactive for <invalid username> from 205.186.180.44 port 42742 ssh2
|
|
# failJSON: { "time": "2005-04-30T01:42:12", "match": true , "host": "205.186.180.77" }
|
|
Apr 30 01:42:12 Jamess-iMac.local sshd[2554]: Failed keyboard-interactive/pam for invalid user jamedds from 205.186.180.77 port 33723 ssh2
|
|
# failJSON: { "time": "2005-04-29T12:53:38", "match": true , "host": "205.186.180.88" }
|
|
Apr 29 12:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication failure for james from 205.186.180.88 via 192.168.1.201
|
|
# failJSON: { "time": "2005-04-29T13:53:38", "match": true , "host": "205.186.180.99" }
|
|
Apr 29 13:53:38 Jamess-iMac.local sshd[47831]: error: PAM: Authentication failure for james from 205.186.180.99 via 192.168.1.201
|
|
# failJSON: { "time": "2005-04-29T15:53:38", "match": true , "host": "205.186.180.100" }
|
|
Apr 29 15:53:38 Jamess-iMac.local sshd[47831]: error: PAM: Authentication error for james from 205.186.180.100 via 192.168.1.201
|
|
# failJSON: { "time": "2005-04-29T16:53:38", "match": true , "host": "205.186.180.101" }
|
|
Apr 29 16:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.101 via 192.168.1.201
|
|
# failJSON: { "time": "2005-04-29T17:53:38", "match": true , "host": "205.186.180.102" }
|
|
Apr 29 17:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.102
|
|
# failJSON: { "time": "2005-04-29T18:53:38", "match": true , "host": "205.186.180.103" }
|
|
Apr 29 18:53:38 Jamess-iMac.local sshd[47831]: error: PAM: authentication error for james from 205.186.180.103
|
|
|
|
#11 https://github.com/fail2ban/fail2ban/issues/267 There might be no colon after [daemon]
|
|
# failJSON: { "time": "2005-06-25T23:53:34", "match": true , "host": "1.2.3.4" }
|
|
Jun 25 23:53:34 [sshd] User root from 1.2.3.4 not allowed because not listed in AllowUsers
|
|
# failJSON: { "time": "2004-12-12T20:04:39", "match": true , "host": "10.215.4.227" }
|
|
Dec 12 20:04:39 aragorn sshd[1328]: error: PAM: User not known to the underlying authentication module for illegal user kernelitshell from 10.215.4.227
|
|
# failJSON: { "time": "2005-03-26T04:56:27", "match": true , "host": "example.com" }
|
|
Mar 26 04:56:27 angel sshd[9739]: User allena from example.com not allowed because not in any group
|
|
# failJSON: { "time": "2005-02-07T16:01:07", "match": true , "host": "192.51.100.54" }
|
|
Feb 7 16:01:07 linux-m899 sshd[5106]: User root from 192.51.100.54 not allowed because a group is listed in DenyGroups
|
|
# failJSON: { "time": "2005-01-05T11:15:05", "match": true , "host": "10.0.0.40" }
|
|
Jan 5 11:15:05 NAS sshd[1966]: User root from 10.0.0.40 not allowed because none of user's groups are listed in AllowGroups
|
|
|
|
# failJSON: { "time": "2004-09-29T16:28:02", "match": true , "host": "127.0.0.1" }
|
|
Sep 29 16:28:02 spaceman sshd[16699]: Failed password for dan from 127.0.0.1 port 45416 ssh1
|
|
|
|
# failJSON: { "time": "2004-09-29T17:15:02", "match": true , "host": "127.0.0.1" }
|
|
Sep 29 17:15:02 spaceman sshd[12946]: Failed hostbased for dan from 127.0.0.1 port 45785 ssh2: RSA 8c:e3:aa:0f:64:51:02:f7:14:79:89:3f:65:84:7c:30, client user "dan", client host "localhost.localdomain"
|
|
|
|
# failJSON: { "time": "2004-09-29T17:15:02", "match": true , "host": "127.0.0.1" }
|
|
Sep 29 17:15:02 spaceman sshd[12946]: Failed hostbased for dan from 127.0.0.1 port 45785 ssh2: DSA 01:c0:79:41:91:31:9a:7d:95:23:91:ac:b1:6d:59:81, client user "dan", client host "localhost.localdomain"
|
|
|
|
# failJSON: { "time": "2004-09-29T17:15:02", "match": true , "host": "127.0.0.1", "desc": "Injecting into rhost for the format of OpenSSH >=6.3" }
|
|
Sep 29 17:15:02 spaceman sshd[12946]: Failed password for user from 127.0.0.1 port 20000 ssh1: ruser from 1.2.3.4
|
|
|
|
# failJSON: { "time": "2004-09-29T17:15:02", "match": true , "host": "127.0.0.1", "desc": "Injecting while exhausting initially present {0,100} match length limits set for ruser etc" }
|
|
Sep 29 17:15:02 spaceman sshd[12946]: Failed password for user from 127.0.0.1 port 20000 ssh1: ruser XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX from 1.2.3.4
|
|
|
|
# failJSON: { "time": "2004-11-11T08:04:51", "match": true , "host": "127.0.0.1", "desc": "Injecting on username ssh 'from 10.10.1.1'@localhost" }
|
|
Nov 11 08:04:51 redbamboo sshd[2737]: Failed password for invalid user from 10.10.1.1 from 127.0.0.1 port 58946 ssh2
|