From 569c24fe5a361fbd8575295dd77c9b41a5446891 Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 21 Jul 2008 10:31:40 -0400
Subject: [PATCH] Added failregex for "User not known" in sshd.conf. thanks
 Alexander Gerasiov (closes: #479966)

---
 config/filter.d/sshd.conf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 691fb240..25bcba21 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -24,6 +24,7 @@ _daemon = sshd
 # Values:  TEXT
 #
 failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
+            ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
             ^%(__prefix_line)sFailed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
             ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
             ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$