From 40c56b10a0f91a84377ccecc38ecdfc01cdeafdc Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Tue, 30 Apr 2013 23:27:16 +1000 Subject: [PATCH 1/2] EHN: enhance sshd filter for bsd. --- config/filter.d/sshd.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index b4e645c4..f9d9c050 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -23,7 +23,7 @@ _daemon = sshd # (?:::f{4,6}:)?(?P[\w\-.^_]+) # Values: TEXT # -failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from \s*$ +failregex = ^%(__prefix_line)s(?:error: PAM: )?[A|a]uthentication (?:failure|error) for .* from \s*$ ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from \s*$ ^%(__prefix_line)sFailed \S+ for .* from (?: port \d*)?(?: ssh\d*)?\s*$ ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM \s*$ From be725ae5c39ab7dfb7c73e7f112806bb5ef473de Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Fri, 3 May 2013 16:19:44 +1000 Subject: [PATCH 2/2] DOC: credits for BSD ssh filter changes --- ChangeLog | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index c80e3b3c..b10931be 100644 --- a/ChangeLog +++ b/ChangeLog @@ -96,7 +96,8 @@ Borreli, blotus: * [7cd6dab] Added help command to fail2ban-client. * [c8c7b0b,23bbc60] Better logging of log file read errors. * [3665e6d] Added code coverage to development process. - * [41b9f7b,32d10e9] More complete ssh filter rules to match openssh source. + * [41b9f7b,32d10e9,39750b8] More complete ssh filter rules to match openssh + source. Also include BSD changes. * [1d9abd1] Action files can have tags in definition that refer to other tags. Pascal Borreli