From 475aa68c113da7c4d93cd5d9df490e2666e80ecf Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Thu, 7 Jun 2007 21:29:25 +0000
Subject: [PATCH] - Fixed vulnerability in sshd.conf. Thanks to Daniel B. Cid

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@588 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 CHANGELOG                 | 1 +
 config/filter.d/sshd.conf | 9 +++++----
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index d6228b31..2c3d5ef5 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -11,6 +11,7 @@ ver. 0.9.0 (2007/??/??) - alpha
 ----------
 - Removed Python 2.4 code. Need more testing
 - Made interactive mode optional in fail2ban-client
+- Fixed vulnerability in sshd.conf. Thanks to Daniel B. Cid
 
 ver. 0.8.0 (2007/05/03) - stable
 ----------
diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index fa1d88ad..39416f43 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -14,10 +14,11 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = Authentication failure for .* from <HOST>
-            Failed [-/\w]+ for .* from <HOST>
-            ROOT LOGIN REFUSED .* FROM <HOST>
-            [iI](?:llegal|nvalid) user .* from <HOST>
+failregex = Authentication failure for .* from <HOST>$
+            Failed [-/\w]+ for .* from <HOST>$
+            ROOT LOGIN REFUSED .* FROM <HOST>$
+            [iI](?:llegal|nvalid) user .* from <HOST>$
+            User .* from <HOST> not allowed because not listed in AllowUsers$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.