| 4 |
- |
1 |
# Fail2Ban filter for openssh
|
|
|
2 |
#
|
| 34 |
- |
3 |
# If you want to protect OpenSSH from being bruteforced by password
|
|
|
4 |
# authentication then get public key authentication working before disabling
|
|
|
5 |
# PasswordAuthentication in sshd_config.
|
|
|
6 |
#
|
|
|
7 |
#
|
|
|
8 |
# "Connection from <HOST> port \d+" requires LogLevel VERBOSE in sshd_config
|
|
|
9 |
#
|
| 4 |
- |
10 |
|
|
|
11 |
[INCLUDES]
|
|
|
12 |
|
|
|
13 |
# Read common prefixes. If any customizations available -- read them from
|
|
|
14 |
# common.local
|
|
|
15 |
before = common.conf
|
|
|
16 |
|
|
|
17 |
[Definition]
|
|
|
18 |
|
|
|
19 |
_daemon = sshd
|
|
|
20 |
|
| 87 |
- |
21 |
failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|error|failed) for .* from <HOST>( via \S+)?\s*$
|
| 4 |
- |
22 |
^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
|
| 87 |
- |
23 |
^%(__prefix_line)sFailed \S+ for (?P<cond_inv>invalid user )?(?P<user>(?P<cond_user>\S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+)) from <HOST>(?: port \d+)?(?: ssh\d*)?(?(cond_user):|(?:(?:(?! from ).)*)$)
|
| 4 |
- |
24 |
^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
|
| 87 |
- |
25 |
^%(__prefix_line)s[iI](?:llegal|nvalid) user .*? from <HOST>(?: port \d+)?\s*$
|
| 4 |
- |
26 |
^%(__prefix_line)sUser .+ from <HOST> not allowed because not listed in AllowUsers\s*$
|
|
|
27 |
^%(__prefix_line)sUser .+ from <HOST> not allowed because listed in DenyUsers\s*$
|
|
|
28 |
^%(__prefix_line)sUser .+ from <HOST> not allowed because not in any group\s*$
|
|
|
29 |
^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
|
| 71 |
- |
30 |
^%(__prefix_line)s(?:error: )?Received disconnect from <HOST>: 3: .*: Auth fail(?: \[preauth\])?$
|
| 4 |
- |
31 |
^%(__prefix_line)sUser .+ from <HOST> not allowed because a group is listed in DenyGroups\s*$
|
|
|
32 |
^%(__prefix_line)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$
|
| 34 |
- |
33 |
^(?P<__prefix>%(__prefix_line)s)User .+ not allowed because account is locked<SKIPLINES>(?P=__prefix)(?:error: )?Received disconnect from <HOST>: 11: .+ \[preauth\]$
|
|
|
34 |
^(?P<__prefix>%(__prefix_line)s)Disconnecting: Too many authentication failures for .+? \[preauth\]<SKIPLINES>(?P=__prefix)(?:error: )?Connection closed by <HOST> \[preauth\]$
|
|
|
35 |
^(?P<__prefix>%(__prefix_line)s)Connection from <HOST> port \d+(?: on \S+ port \d+)?<SKIPLINES>(?P=__prefix)Disconnecting: Too many authentication failures for .+? \[preauth\]$
|
| 71 |
- |
36 |
^%(__prefix_line)s(error: )?maximum authentication attempts exceeded for .* from <HOST>(?: port \d*)?(?: ssh\d*)? \[preauth\]$
|
| 34 |
- |
37 |
^%(__prefix_line)spam_unix\(sshd:auth\):\s+authentication failure;\s*logname=\S*\s*uid=\d*\s*euid=\d*\s*tty=\S*\s*ruser=\S*\s*rhost=<HOST>\s.*$
|
| 4 |
- |
38 |
|
|
|
39 |
ignoreregex =
|
|
|
40 |
|
| 34 |
- |
41 |
[Init]
|
|
|
42 |
|
|
|
43 |
# "maxlines" is number of log lines to buffer for multi-line regex searches
|
|
|
44 |
maxlines = 10
|
|
|
45 |
|
|
|
46 |
journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=sshd
|
|
|
47 |
|
| 4 |
- |
48 |
# DEV Notes:
|
|
|
49 |
#
|
|
|
50 |
# "Failed \S+ for .*? from <HOST>..." failregex uses non-greedy catch-all because
|
|
|
51 |
# it is coming before use of <HOST> which is not hard-anchored at the end as well,
|
|
|
52 |
# and later catch-all's could contain user-provided input, which need to be greedily
|
|
|
53 |
# matched away first.
|
|
|
54 |
#
|
|
|
55 |
# Author: Cyril Jaquier, Yaroslav Halchenko, Petr Voralek, Daniel Black
|
| 34 |
- |
56 |
|