# HG changeset patch
# User IBBoard <dev@ibboard.co.uk>
# Date 1570039139 -3600
# Node ID 1a4b0d0ba9482324679872041a97051961cadd04
# Parent  82222d8bd867e5ac5d46cd6f1b4661d9242d9451
Blacklist more bad user requests

Helpdesks, engineers and a variant on an existing one

diff -r 82222d8bd867 -r 1a4b0d0ba948 common/fail2ban/ibb-sshd-bad-user.conf
--- a/common/fail2ban/ibb-sshd-bad-user.conf	Mon Sep 23 19:47:37 2019 +0100
+++ b/common/fail2ban/ibb-sshd-bad-user.conf	Wed Oct 02 18:58:59 2019 +0100
@@ -10,7 +10,7 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = Failed password for invalid user ([0-9]+|[0-9a-z][0-9a-z]?|([0-9a-z]){3}|abc123|abused|adm|admin[0-9]+|administrateur|administracion|alumni|amavisd?|anwenderschnittstelle|anonymous|ansible|aptproxy|arkserver|asterisk|backup(s|er|user)|bf2|bitnami|bitrix|boinc|botmaster|build|buscador|cacti(user)?|catchall|cemergen|chef|cinema|cliente?[0-9]*|clouduser|com|comercial|control|create|cron|(cs(s|go|cz)|mc|tf2?|sdtd|web|pz)se?rve?r?|daemon|danger|debian|dell|deploy(er)?|desktop|devteam|django|download|easy|ec2-user|edu(cation)?|e-shop|events|facebook|factorio|fax|filter|fuser|games|gdm|geniuz|ggc_user|git(olite?|blit|lab(_ci)?)?|gmail|guest|hadoop|harvard|helpdesk|huawei|iceuser|informix|jboss|jira|jsboss|kafka|kodi|library|linode|linux|login|mailer|mailman|majordomo|man|mantis|marketing|master|minecraft|modem|mongo(db|user)|monitor|more|mpiuser|musi[ck]bot|(my|pg)sq(ue)?l|nagios|nasa|netdump|netzplatz|newadmin|nexus|(nfs)?nobody|noc|nothing|NpC|nux|odoo|onyxeye|openbravo|operador|operator|ops(code)?|oprofile|ora(cle|prod)|papernet|password|pay_?pal|pentaho|PlcmSpIp(PlcmSpIp)?|postfix|postgres|print|privoxy|puppet|qhsupport|rabbit(mq)?|radiusd?|redis|redmine|root[0-9]+|rpc(user)?|rtorrent|sales[0-9]+|s?bin|(samba|sshd|git|student|tomcat|abc|web|info|(vpn|appl?|my|b)?(use?r|server|manager|mgr)|account)[0-9]*|saslauth|screen|search|(s|u|ams|admin|inss|pro)?ftp(d|user|home|_?test)?[0-9]*|shop|sinusbot|socket|software|splunk|squid|squirrelmail|sshusr|staffc|steam(cmd)?|superuser|svnroot|sysadmin|system|teamspeak3?|test((ing|ftp|man|use?r)[0-9]*|[0-9]+)|(test)?username|tomcat|tools|toor|ts[23](serv(er)?|(musi[ck])?bot)?|ubnt|ubuntu|USERID|user[0-9]+|usuario|vagrant|vbox|ventrilo|vhbackup|virusalter|vmail|vyatta|weblogic|WinD3str0y|wp-user|write|www|(www|web|coin|fax|sys|db2|rsync|tc)-?(adm(in)?|run|user|data)|yahoo|zabbix|zimbra|zookeeper) from <HOST> port [0-9]+ ssh2
+failregex = Failed password for invalid user ([0-9]+|[0-9a-z][0-9a-z]?|([0-9a-z]){3}|abc123|abused|adm|admin[0-9]+|administrateur|administracion|alumni|amavisd?|anwenderschnittstelle|anonymous|ansible|aptproxy|arkserver|asterisk|backup(s|er|user)|bf2|bitnami|bitrix|boinc|botmaster|build|buscador|cacti(user)?|catchall|cemergen|chef|cinema|cliente?[0-9]*|clouduser|com|comercial|control|create|cron|(cs(s|go|cz)|mc|tf2?|sdtd|web|pz)se?rve?r?|daemon|danger|debian|dell|deploy(er)?|desktop|devteam|django|download|easy|ec2-user|edu(cation)?|e-shop|engin(eer)?|events|facebook|factorio|fax|filter|fuser|games|gdm|geniuz|ggc_user|git(olite?|blit|lab(_ci)?)?|gmail|guest|hadoop|harvard|helpdesk|huawei|iceuser|imscp|informix|jboss|jira|jsboss|kafka|kodi|library|linode|linux|login|mailer|mailman|majordomo|man|mantis|marketing|master|minecraft|modem|mongo(db|user)|monitor|more|mpiuser|musi[ck]bot|(my|pg)sq(ue)?l|nagios|nasa|netdump|netzplatz|newadmin|nexus|(nfs)?nobody|noc|nothing|NpC|nux|odoo|onyxeye|openbravo|operador|operator|ops(code)?|oprofile|ora(cle|prod)|papernet|password|pay_?pal|pentaho|PlcmSpIp(PlcmSpIp)?|postfix|postgres|print|privoxy|puppet|qhsupport|rabbit(mq)?|radiusd?|redis|redmine|root[0-9]+|rpc(user)?|rtorrent|sales[0-9]+|s?bin|(samba|sshd|git|student|tomcat|abc|web|info|(vpn|appl?|my|b)?(use?r|server|manager|mgr)|account)[0-9]*|saslauth|screen|search|(s|u|ams|admin|inss|pro)?ftp(d|user|home|_?test)?[0-9]*|shop|sinusbot|socket|software|splunk|squid|squirrelmail|sshusr|staffc|steam(cmd)?|superuser|svnroot|sysadmin|system|teamspeak3?|test((ing|ftp|man|use?r)[0-9]*|[0-9]+)|(test)?username|tomcat|tools|toor|ts[23](serv(er)?|(musi[ck])?bot)?|ubnt|ubuntu|USERID|user[0-9]+|usuario|vagrant|vbox|ventrilo|vhbackup|virusalter|vmail|vyatta|weblogic|WinD3str0y|wp-?user|write|www|(www|web|coin|fax|sys|db2|rsync|tc)-?(adm(in)?|run|user|data)|yahoo|zabbix|zimbra|zookeeper) from <HOST> port [0-9]+ ssh2
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.