FM / filter.d

/etc/fail2ban/filter.d

Name	Size	Mode	Actions
ignorecommands/	-	0755	rm
3proxy.conf	467	0644	edit dl rm
apache-auth.conf	3228	0644	edit dl rm
apache-badbots.conf	2831	0644	edit dl rm
apache-botsearch.conf	1265	0644	edit dl rm
apache-common.conf	1619	0644	edit dl rm
apache-fakegooglebot.conf	324	0644	edit dl rm
apache-modsecurity.conf	511	0644	edit dl rm
apache-nohome.conf	596	0644	edit dl rm
apache-noscript.conf	1246	0644	edit dl rm
apache-overflows.conf	2184	0644	edit dl rm
apache-pass.conf	362	0644	edit dl rm
apache-shellshock.conf	1020	0644	edit dl rm
assp.conf	3492	0644	edit dl rm
asterisk.conf	2369	0644	edit dl rm
bitwarden.conf	427	0644	edit dl rm
botsearch-common.conf	522	0644	edit dl rm
centreon.conf	307	0644	edit dl rm
common.conf	2775	0644	edit dl rm
counter-strike.conf	244	0644	edit dl rm
courier-auth.conf	463	0644	edit dl rm
courier-smtp.conf	512	0644	edit dl rm
cyrus-imap.conf	444	0644	edit dl rm
directadmin.conf	338	0644	edit dl rm
domino-smtp.conf	2107	0644	edit dl rm
dovecot.conf	2453	0644	edit dl rm
dropbear.conf	1730	0644	edit dl rm
drupal-auth.conf	557	0644	edit dl rm
ejabberd-auth.conf	1572	0644	edit dl rm
exim-common.conf	516	0644	edit dl rm
exim-spam.conf	2158	0644	edit dl rm
exim.conf	2875	0644	edit dl rm
freeswitch.conf	1922	0644	edit dl rm
froxlor-auth.conf	1210	0644	edit dl rm
gitlab.conf	236	0644	edit dl rm
grafana.conf	388	0644	edit dl rm
groupoffice.conf	236	0644	edit dl rm
gssftpd.conf	322	0644	edit dl rm
guacamole.conf	1447	0644	edit dl rm
haproxy-http-auth.conf	1170	0644	edit dl rm
horde.conf	404	0644	edit dl rm
kerio.conf	938	0644	edit dl rm
lighttpd-auth.conf	333	0644	edit dl rm
mongodb-auth.conf	2279	0644	edit dl rm
monit.conf	787	0644	edit dl rm
murmur.conf	927	0644	edit dl rm
mysqld-auth.conf	953	0644	edit dl rm
nagios.conf	400	0644	edit dl rm
named-refused.conf	1496	0644	edit dl rm
nginx-botsearch.conf	681	0644	edit dl rm
nginx-http-auth.conf	485	0644	edit dl rm
nginx-limit-req.conf	1454	0644	edit dl rm
nsd.conf	760	0644	edit dl rm
openhab.conf	452	0644	edit dl rm
openwebmail.conf	495	0644	edit dl rm
oracleims.conf	1937	0644	edit dl rm
pam-generic.conf	947	0644	edit dl rm
perdition.conf	568	0644	edit dl rm
php-url-fopen.conf	891	0644	edit dl rm
phpmyadmin-syslog.conf	278	0644	edit dl rm
portsentry.conf	242	0644	edit dl rm
postfix.conf	3164	0644	edit dl rm
proftpd.conf	1163	0644	edit dl rm
pure-ftpd.conf	2409	0644	edit dl rm
qmail.conf	795	0644	edit dl rm
recidive.conf	1374	0644	edit dl rm
roundcube-auth.conf	1541	0644	edit dl rm
scanlogd.conf	354	0644	edit dl rm
screensharingd.conf	821	0644	edit dl rm
selinux-common.conf	538	0644	edit dl rm
selinux-ssh.conf	570	0644	edit dl rm
sendmail-auth.conf	776	0644	edit dl rm
sendmail-reject.conf	2949	0644	edit dl rm
sieve.conf	371	0644	edit dl rm
slapd.conf	706	0644	edit dl rm
softethervpn.conf	451	0644	edit dl rm
sogo-auth.conf	722	0644	edit dl rm
solid-pop3d.conf	1094	0644	edit dl rm
squid.conf	260	0644	edit dl rm
squirrelmail.conf	191	0644	edit dl rm
sshd.conf	7518	0644	edit dl rm
stunnel.conf	363	0644	edit dl rm
suhosin.conf	649	0644	edit dl rm
tine20.conf	890	0644	edit dl rm
traefik-auth.conf	2390	0644	edit dl rm
uwimap-auth.conf	374	0644	edit dl rm
vsftpd.conf	637	0644	edit dl rm
webmin-auth.conf	444	0644	edit dl rm
wordpress.conf	93	0644	edit dl rm
wuftpd.conf	520	0644	edit dl rm
xinetd-fail.conf	521	0644	edit dl rm
znc-adminlog.conf	912	0644	edit dl rm
zoneminder.conf	524	0644	edit dl rm

Edit: /etc/fail2ban/filter.d/sshd.conf (7518B)

# Fail2Ban filter for openssh
#
# If you want to protect OpenSSH from being bruteforced by password
# authentication then get public key authentication working before disabling
# PasswordAuthentication in sshd_config.
#
#
# "Connection from <HOST> port \d+" requires LogLevel VERBOSE in sshd_config
#

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[DEFAULT]

_daemon = sshd

# optional prefix (logged from several ssh versions) like "error: ", "error: PAM: " or "fatal: "
__pref = (?:(?:error|fatal): (?:PAM: )?)?
# optional suffix (logged from several ssh versions) like " [preauth]"
#__suff = (?: port \d+)?(?: \[preauth\])?\s*
__suff = (?: (?:port \d+|on \S+|\[preauth\])){0,3}\s*
__on_port_opt = (?: (?:port \d+|on \S+)){0,2}
# close by authenticating user:
__authng_user = (?: (?:invalid|authenticating) user <F-USER>\S+|.*?</F-USER>)?

# for all possible (also future) forms of "no matching (cipher|mac|MAC|compression method|key exchange method|host key type) found",
# see ssherr.c for all possible SSH_ERR_..._ALG_MATCH errors.
__alg_match = (?:(?:\w+ (?!found\b)){0,2}\w+)

# PAM authentication mechanism, can be overridden, e. g. `filter = sshd[__pam_auth='pam_ldap']`:
__pam_auth = pam_[a-z]+

[Definition]

prefregex = ^<F-MLFID>%(__prefix_line)s</F-MLFID>%(__pref)s<F-CONTENT>.+</F-CONTENT>$

cmnfailre = ^[aA]uthentication (?:failure|error|failed) for <F-USER>.*</F-USER> from <HOST>( via \S+)?%(__suff)s$
            ^User not known to the underlying authentication module for <F-USER>.*</F-USER> from <HOST>%(__suff)s$
            <cmnfailre-failed-pub-<publickey>>
            ^Failed <cmnfailed> for (?P<cond_inv>invalid user )?<F-USER>(?P<cond_user>\S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+)</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)
            ^<F-USER>ROOT</F-USER> LOGIN REFUSED FROM <HOST>
            ^[iI](?:llegal|nvalid) user <F-USER>.*?</F-USER> from <HOST>%(__suff)s$
            ^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because not listed in AllowUsers%(__suff)s$
            ^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because listed in DenyUsers%(__suff)s$
            ^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because not in any group%(__suff)s$
            ^refused connect from \S+ $<HOST>$
            ^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(__on_port_opt)s:\s*3: .*: Auth fail%(__suff)s$
            ^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because a group is listed in DenyGroups%(__suff)s$
            ^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because none of user's groups are listed in AllowGroups%(__suff)s$
            ^<F-NOFAIL>%(__pam_auth)s$sshd:auth$:\s+authentication failure;</F-NOFAIL>(?:\s+(?:(?:logname|e?uid|tty)=\S*)){0,4}\s+ruser=<F-ALT_USER>\S*</F-ALT_USER>\s+rhost=<HOST>(?:\s+user=<F-USER>\S*</F-USER>)?%(__suff)s$
            ^maximum authentication attempts exceeded for <F-USER>.*</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?%(__suff)s$
            ^User <F-USER>\S+|.*?</F-USER> not allowed because account is locked%(__suff)s
            ^<F-MLFFORGET>Disconnecting</F-MLFFORGET>(?: from)?(?: (?:invalid|authenticating)) user <F-USER>\S+</F-USER> <HOST>%(__on_port_opt)s:\s*Change of username or service not allowed:\s*.*\[preauth\]\s*$
            ^Disconnecting: Too many authentication failures(?: for <F-USER>\S+|.*?</F-USER>)?%(__suff)s$
            ^<F-NOFAIL>Received <F-MLFFORGET>disconnect</F-MLFFORGET></F-NOFAIL> from <HOST>%(__on_port_opt)s:\s*11:
            <mdre-<mode>-other>
            ^<F-MLFFORGET><F-MLFGAINED>Accepted \w+</F-MLFGAINED></F-MLFFORGET> for <F-USER>\S+</F-USER> from <HOST>(?:\s|$)

cmnfailed-any = \S+
cmnfailed-ignore = \b(?!publickey)\S+
cmnfailed-invalid = <cmnfailed-ignore>
cmnfailed-nofail = (?:<F-NOFAIL>publickey</F-NOFAIL>|\S+)
cmnfailed = <cmnfailed-<publickey>>

mdre-normal =
# used to differentiate "connection closed" with and without `[preauth]` (fail/nofail cases in ddos mode)
mdre-normal-other = ^<F-NOFAIL><F-MLFFORGET>(Connection closed|Disconnected)</F-MLFFORGET></F-NOFAIL> (?:by|from)%(__authng_user)s <HOST>(?:%(__suff)s|\s*)$

mdre-ddos = ^Did not receive identification string from <HOST>
            ^kex_exchange_identification: (?:[Cc]lient sent invalid protocol identifier|[Cc]onnection closed by remote host)
            ^Bad protocol version identification '.*' from <HOST>
            ^<F-NOFAIL>SSH: Server;Ltype:</F-NOFAIL> (?:Authname|Version|Kex);Remote: <HOST>-\d+;[A-Z]\w+:
            ^Read from socket failed: Connection <F-MLFFORGET>reset</F-MLFFORGET> by peer
# same as mdre-normal-other, but as failure (without <F-NOFAIL>) and [preauth] only:
mdre-ddos-other = ^<F-MLFFORGET>(Connection (?:closed|reset)|Disconnected)</F-MLFFORGET> (?:by|from)%(__authng_user)s <HOST>%(__on_port_opt)s\s+\[preauth\]\s*$

mdre-extra = ^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(__on_port_opt)s:\s*14: No(?: supported)? authentication methods available
            ^Unable to negotiate with <HOST>%(__on_port_opt)s: no matching <__alg_match> found.
            ^Unable to negotiate a <__alg_match>
            ^no matching <__alg_match> found:
# part of mdre-ddos-other, but user name is supplied (invalid/authenticating) on [preauth] phase only:
mdre-extra-other = ^<F-MLFFORGET>Disconnected</F-MLFFORGET>(?: from)?(?: (?:invalid|authenticating)) user <F-USER>\S+|.*?</F-USER> <HOST>%(__on_port_opt)s \[preauth\]\s*$

mdre-aggressive = %(mdre-ddos)s
                  %(mdre-extra)s
# mdre-extra-other is fully included within mdre-ddos-other:
mdre-aggressive-other = %(mdre-ddos-other)s

# Parameter "publickey": nofail (default), invalid, any, ignore
publickey = nofail
# consider failed publickey for invalid users only:
cmnfailre-failed-pub-invalid = ^Failed publickey for invalid user <F-USER>(?P<cond_user>\S+)|(?:(?! from ).)*?</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)
# consider failed publickey for valid users too (don't need RE, see cmnfailed):
cmnfailre-failed-pub-any =
# same as invalid, but consider failed publickey for valid users too, just as no failure (helper to get IP and user-name only, see cmnfailed):
cmnfailre-failed-pub-nofail = <cmnfailre-failed-pub-invalid>
# don't consider failed publickey as failures (don't need RE, see cmnfailed):
cmnfailre-failed-pub-ignore =

cfooterre = ^<F-NOFAIL>Connection from</F-NOFAIL> <HOST>

failregex = %(cmnfailre)s
            <mdre-<mode>>
            %(cfooterre)s

# Parameter "mode": normal (default), ddos, extra or aggressive (combines all)
# Usage example (for jail.local):
#   [sshd]
#   mode = extra
#   # or another jail (rewrite filter parameters of jail):
#   [sshd-aggressive]
#   filter = sshd[mode=aggressive]
#
mode = normal

#filter = sshd[mode=aggressive]

ignoreregex =

maxlines = 1

journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=sshd

# DEV Notes:
#
#   "Failed \S+ for .*? from <HOST>..." failregex uses non-greedy catch-all because
#   it is coming before use of <HOST> which is not hard-anchored at the end as well,
#   and later catch-all's could contain user-provided input, which need to be greedily
#   matched away first.
#
# Author: Cyril Jaquier, Yaroslav Halchenko, Petr Voralek, Daniel Black and Sergey Brester aka sebres
# Rewritten using prefregex (and introduced "mode" parameter) by Serg G. Brester.

cmd: