# Fail2Ban configuration file
# Author: IBBoard

[Definition]

# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values:  TEXT
#
failregex = Failed password for invalid user ([0-9]+|[0-9a-z][0-9a-z]?|([0-9a-z]){3}|abc123|abused|adm|admin[0-9]+|administrateur|alumni|amavisd?|anonymous|ansible|aptproxy|asterisk|backup(s|er|user)|bf2|bitnami|bitrix|botmaster|build|buscador|catchall|cemergen|chef|client|clouduser|com|comercial|control|create|cron|(cs(s|go|cz)|mc|tf2?|sdtd|web|pz)(server|srv)|daemon|danger|debian|dell|deploy|desktop|devteam|django|download|easy|ec2-user|edu(cation)?|e-shop|facebook|filter|fuser|games|gdm|geniuz|ggc_user|git(olite?|blit|lab(_ci)?)?|gmail|guest|hadoop|harvard|huawei|info|jboss|jira|jsboss|kafka|kodi|library|linode|mailer|majordomo|man|mantis|master|minecraft|modem|mongodb|monitor|more|(my|pg)sq(ue)?l|nagios|nasa|netdump|newadmin|nexus|(nfs)?nobody|noc|nothing|NpC|operador|operator|opscode|ora(cle|prod)|papernet|password|pay_?pal|pentaho|PlcmSpIp(PlcmSpIp)?|postfix|postgres|print|privoxy|qhsupport|rabbit(mq)?|redis|redmine|root[0-9]+|rpc(user)?|sales[0-9]+|(samba|sshd|git|student|tomcat|abc|web|(vpn|appl?)?(use?r|server|manager|mgr)|account)[0-9]*|screen|search|(s|u|ams|admin|inss|pro)?ftp(d|user|home|test)?[0-9]*|shop|sinusbot|socket|software|splunk|squid|squirrelmail|sshusr|staffc|steam(cmd)?|superuser|svnroot|sysadmin|system|teamspeak3?|test(ing|ftp|man|use?r)[0-9]*|(test)?username|tomcat|tools|ts3(serv(er)?|(music)?bot)?|ubnt|ubuntu|USERID|user[0-9]+|usuario|vagrant|ventrilo|vhbackup|vmail|vyatta|weblogic|WinD3str0y|wp-user|write|www|(www|web|coin|fax|sys|db2)-?(adm(in)?|run|user|data)|zabbix|zimbra) from <HOST> port [0-9]+ ssh2

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =