Mercurial > repos > other > Puppet

annotate common/fail2ban/ibb-sshd-bad-user.conf @ 233:68bc75ceb7c1 puppet-3.6

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Blacklist more SSH attempts Includes: * Blank username * Tunstall * What appear to be passwords * More services like openvpn and uucp
author IBBoard <dev@ibboard.co.uk>
date Fri, 06 Dec 2019 20:53:55 +0000
parents 48dee1ddd26a
children d91fb2fedbae
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
197
23c4f6a38b57 Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
1 # Fail2Ban configuration file
23c4f6a38b57 Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
2 # Author: IBBoard
23c4f6a38b57 Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
3
23c4f6a38b57 Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
4 [Definition]
23c4f6a38b57 Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
5
23c4f6a38b57 Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
6 # Option: failregex
23c4f6a38b57 Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
7 # Notes.: regex to match the password failures messages in the logfile. The
23c4f6a38b57 Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
8 # host must be matched by a group named "host". The tag "<HOST>" can
23c4f6a38b57 Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
9 # be used for standard IP/hostname matching and is only an alias for
23c4f6a38b57 Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
10 # (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
23c4f6a38b57 Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
11 # Values: TEXT
23c4f6a38b57 Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
12 #
233
68bc75ceb7c1 Blacklist more SSH attempts
IBBoard <dev@ibboard.co.uk>
parents: 232
diff changeset
13 failregex = Failed password for invalid user ([0-9]+|[0-9a-z][0-9a-z]?|([0-9a-z]){3,}|abc123|abused|adm|admin[0-9]+|administrateur|administracion|altibase|alumni|amavisd?|anwenderschnittstelle|anonymous|ansible|aptproxy|arkserver|asterisk|avis|backlog|backup(s|er|pc|user)?|bf2|bitnami|bitrix|boinc|botmaster|build|buscador|cacti(user)?|catchall|cemergen|chef|cinema|cliente?[0-9]*|clouduser|com|comercial|control|create|cron|(cs(s|go|cz)|arma|mc|tf2?|sdtd|web|pz)se?rve?r?|daemon|danger|debian|dell|deploy(er)?|desktop|devteam|dietpi|django|dotblot|download|easy|ec2-user|edu(cation)?[0-9]*|e-shop|engin(eer)?|events|exports?|facebook|factorio|fax|filter|fuser|games|gdm|geniuz|ggc_user|ghost|git(olite?|blit|lab(_ci)?)?|gmail|guest|hadoop|harvard|helpdesk|httpd?|huawei|iceuser|imscp|informix|java|jboss|jira|jsboss|kafka|kodi|library|libsys|linode|linux|login|logout|mailer|mailman|majordomo|man|mantis|marketing|master|minecraft|modem|mongo(db|user)|monitor|more|mpiuser|musi[ck]bot|(my|pg)sq(ue)?l|nagios|nasa|netdump|netzplatz|newadmin|nexus|(nfs)?nobody|noc|nothing|NpC|nux|odoo|odroid|onyxeye|openbravo|openvpn|operador|operator|ops(code)?|oprofile|ora(cle|prod)|osmc|papernet|password|payments|pay_?pal|pentaho|PlcmSpIp(PlcmSpIp)?|postfix|postgres|print|privoxy|puppet|qhsupport|rabbit(mq)?|radiusd?|redis|redmine|root[0-9]+|rpc(user)?|rtorrent|sales[0-9]+|s?bin|(samba|sshd|git|student|tomcat|abc|web|info|(vpn|appl?|my|b)?(use?r|server|manager|mgr)|account)[0-9]*|saslauth|screen|search|setup|service|(s|u|ams|admin|inss|pro)?ftp(d|_?user|home|_?test)?[0-9]*|shop|sinusbot|smmsp|socket|software|splunk|squid|squirrelmail|sshusr|staffc|steam(cmd)?|superuser|svnroot|sysadmin|system|teamspeak3?|telkom|test((ing|ftp|man|use?r|u)[0-9]*|[0-9]+)|(test)?username|tomcat|tools|toor|ts[23](serv(er)?|(musi[ck])?bot)?|tunstall|ubnt|ubuntu|upload|unity|USERID|user[0-9]+|usuario|uucp|vagrant|vbox|ventrilo|vhbackup|virusalter|vmadmin|vmail|vyatta|weblogic|webmaster|WinD3str0y|wp-?user|write|www|(www|web|coin|fax|sys|db2|rsync|tc)-?(adm(in)?|run|user|data)|xbian|xoadmin|yahoo|zabbix|zimbra|zookeeper|0fordn1on@#\$%%\^&|P@\$\$w0rd|pass123?4?)? from <HOST> port [0-9]+ ssh2
197
23c4f6a38b57 Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
14
23c4f6a38b57 Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
15 # Option: ignoreregex
23c4f6a38b57 Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
16 # Notes.: regex to ignore. If this regex matches, the line is ignored.
23c4f6a38b57 Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
17 # Values: TEXT
23c4f6a38b57 Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
18 #
23c4f6a38b57 Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff changeset
19 ignoreregex =