"Fossies" - the Fresh Open Source Software Archive  

Source code changes of the file "config/filter.d/sshd.conf" between
fail2ban-0.10.3.1.tar.gz and fail2ban-0.10.4.tar.gz

About: fail2ban scans log files and bans (via firewall rules) IP-addresses that makes too many access failures. It updates firewall rules to reject the IP address. Experimental version.

sshd.conf  (fail2ban-0.10.3.1):sshd.conf  (fail2ban-0.10.4)
skipping to change at line 27 skipping to change at line 27
[DEFAULT] [DEFAULT]
_daemon = sshd _daemon = sshd
# optional prefix (logged from several ssh versions) like "error: ", "error: PAM : " or "fatal: " # optional prefix (logged from several ssh versions) like "error: ", "error: PAM : " or "fatal: "
__pref = (?:(?:error|fatal): (?:PAM: )?)? __pref = (?:(?:error|fatal): (?:PAM: )?)?
# optional suffix (logged from several ssh versions) like " [preauth]" # optional suffix (logged from several ssh versions) like " [preauth]"
#__suff = (?: port \d+)?(?: \[preauth\])?\s* #__suff = (?: port \d+)?(?: \[preauth\])?\s*
__suff = (?: (?:port \d+|on \S+|\[preauth\])){0,3}\s* __suff = (?: (?:port \d+|on \S+|\[preauth\])){0,3}\s*
__on_port_opt = (?: (?:port \d+|on \S+)){0,2} __on_port_opt = (?: (?:port \d+|on \S+)){0,2}
# close by authenticating user:
__authng_user = (?: authenticating user <F-USER>\S+|.+?</F-USER>)?
# for all possible (also future) forms of "no matching (cipher|mac|MAC|compressi on method|key exchange method|host key type) found", # for all possible (also future) forms of "no matching (cipher|mac|MAC|compressi on method|key exchange method|host key type) found",
# see ssherr.c for all possible SSH_ERR_..._ALG_MATCH errors. # see ssherr.c for all possible SSH_ERR_..._ALG_MATCH errors.
__alg_match = (?:(?:\w+ (?!found\b)){0,2}\w+) __alg_match = (?:(?:\w+ (?!found\b)){0,2}\w+)
# PAM authentication mechanism, can be overridden, e. g. `filter = sshd[__pam_au th='pam_ldap']`: # PAM authentication mechanism, can be overridden, e. g. `filter = sshd[__pam_au th='pam_ldap']`:
__pam_auth = pam_[a-z]+ __pam_auth = pam_[a-z]+
[Definition] [Definition]
skipping to change at line 57 skipping to change at line 59
^User <F-USER>.+</F-USER> from <HOST> not allowed because not in any group%(__suff)s$ ^User <F-USER>.+</F-USER> from <HOST> not allowed because not in any group%(__suff)s$
^refused connect from \S+ \(<HOST>\) ^refused connect from \S+ \(<HOST>\)
^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(__on_po rt_opt)s:\s*3: .*: Auth fail%(__suff)s$ ^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(__on_po rt_opt)s:\s*3: .*: Auth fail%(__suff)s$
^User <F-USER>.+</F-USER> from <HOST> not allowed because a group is listed in DenyGroups%(__suff)s$ ^User <F-USER>.+</F-USER> from <HOST> not allowed because a group is listed in DenyGroups%(__suff)s$
^User <F-USER>.+</F-USER> from <HOST> not allowed because none of us er's groups are listed in AllowGroups%(__suff)s$ ^User <F-USER>.+</F-USER> from <HOST> not allowed because none of us er's groups are listed in AllowGroups%(__suff)s$
^<F-NOFAIL>%(__pam_auth)s\(sshd:auth\):\s+authentication failure;</F -NOFAIL>(?:\s+(?:(?:logname|e?uid|tty)=\S*)){0,4}\s+ruser=<F-ALT_USER>\S*</F-ALT _USER>\s+rhost=<HOST>(?:\s+user=<F-USER>\S*</F-USER>)?%(__suff)s$ ^<F-NOFAIL>%(__pam_auth)s\(sshd:auth\):\s+authentication failure;</F -NOFAIL>(?:\s+(?:(?:logname|e?uid|tty)=\S*)){0,4}\s+ruser=<F-ALT_USER>\S*</F-ALT _USER>\s+rhost=<HOST>(?:\s+user=<F-USER>\S*</F-USER>)?%(__suff)s$
^(error: )?maximum authentication attempts exceeded for <F-USER>.*</ F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?%(__suff)s$ ^(error: )?maximum authentication attempts exceeded for <F-USER>.*</ F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?%(__suff)s$
^User <F-USER>.+</F-USER> not allowed because account is locked%(__s uff)s ^User <F-USER>.+</F-USER> not allowed because account is locked%(__s uff)s
^<F-MLFFORGET>Disconnecting</F-MLFFORGET>: Too many authentication f ailures(?: for <F-USER>.+?</F-USER>)?%(__suff)s$ ^<F-MLFFORGET>Disconnecting</F-MLFFORGET>: Too many authentication f ailures(?: for <F-USER>.+?</F-USER>)?%(__suff)s$
^<F-NOFAIL>Received <F-MLFFORGET>disconnect</F-MLFFORGET></F-NOFAIL> from <HOST>%(__on_port_opt)s:\s*11: ^<F-NOFAIL>Received <F-MLFFORGET>disconnect</F-MLFFORGET></F-NOFAIL> from <HOST>%(__on_port_opt)s:\s*11:
^<F-NOFAIL>Connection <F-MLFFORGET>closed</F-MLFFORGET></F-NOFAIL> b y <HOST><mdrp-<mode>-suff-onclosed> ^<F-NOFAIL>Connection <F-MLFFORGET>closed</F-MLFFORGET></F-NOFAIL> b y%(__authng_user)s <HOST><mdrp-<mode>-suff-onclosed>
^<F-MLFFORGET><F-NOFAIL>Accepted \w+</F-NOFAIL></F-MLFFORGET> for <F -USER>\S+</F-USER> from <HOST>(?:\s|$) ^<F-MLFFORGET><F-NOFAIL>Accepted \w+</F-NOFAIL></F-MLFFORGET> for <F -USER>\S+</F-USER> from <HOST>(?:\s|$)
mdre-normal = mdre-normal =
# used to differentiate "connection closed" with and without `[preauth]` (fail/n ofail cases in ddos mode) # used to differentiate "connection closed" with and without `[preauth]` (fail/n ofail cases in ddos mode)
mdrp-normal-suff-onclosed = mdrp-normal-suff-onclosed = (?:%(__suff)s|\s*)$
mdre-ddos = ^Did not receive identification string from <HOST> mdre-ddos = ^Did not receive identification string from <HOST>
^Connection <F-MLFFORGET>reset</F-MLFFORGET> by <HOST> ^Connection <F-MLFFORGET>reset</F-MLFFORGET> by <HOST>
^Connection <F-MLFFORGET>closed</F-MLFFORGET> by <HOST>%(__on_port_o pt)s\s+\[preauth\]\s*$ ^Connection <F-MLFFORGET>closed</F-MLFFORGET> by%(__authng_user)s <H OST>%(__on_port_opt)s\s+\[preauth\]\s*$
^<F-NOFAIL>SSH: Server;Ltype:</F-NOFAIL> (?:Authname|Version|Kex);Re mote: <HOST>-\d+;[A-Z]\w+: ^<F-NOFAIL>SSH: Server;Ltype:</F-NOFAIL> (?:Authname|Version|Kex);Re mote: <HOST>-\d+;[A-Z]\w+:
^Read from socket failed: Connection <F-MLFFORGET>reset</F-MLFFORGET > by peer ^Read from socket failed: Connection <F-MLFFORGET>reset</F-MLFFORGET > by peer
mdrp-ddos-suff-onclosed = %(__on_port_opt)s\s*$ mdrp-ddos-suff-onclosed = %(__on_port_opt)s\s*$
mdre-extra = ^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(__on_p ort_opt)s:\s*14: No supported authentication methods available mdre-extra = ^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(__on_p ort_opt)s:\s*14: No supported authentication methods available
^Unable to negotiate with <HOST>%(__on_port_opt)s: no matching <__al g_match> found. ^Unable to negotiate with <HOST>%(__on_port_opt)s: no matching <__al g_match> found.
^Unable to negotiate a <__alg_match> ^Unable to negotiate a <__alg_match>
^no matching <__alg_match> found: ^no matching <__alg_match> found:
mdrp-extra-suff-onclosed = %(mdrp-normal-suff-onclosed)s mdrp-extra-suff-onclosed = %(mdrp-normal-suff-onclosed)s
 End of changes. 4 change blocks. 
3 lines changed or deleted 5 lines changed or added

Home  |  About  |  Features  |  All  |  Newest  |  Dox  |  Diffs  |  RSS Feeds  |  Screenshots  |  Comments  |  Imprint  |  Privacy  |  HTTP(S)