# HG changeset patch
# User IBBoard <dev@ibboard.co.uk>
# Date 1563132812 -3600
# Node ID 1ab81778ae9f90c7a67a5b5886c776b22456bc8c
# Parent  c361ebbf07e436a802477b68e25b40338231e002
Rework and sort username blacklisting

diff -r c361ebbf07e4 -r 1ab81778ae9f common/fail2ban/ibb-sshd-bad-user.conf
--- a/common/fail2ban/ibb-sshd-bad-user.conf	Sun Jul 14 10:47:38 2019 +0100
+++ b/common/fail2ban/ibb-sshd-bad-user.conf	Sun Jul 14 20:33:32 2019 +0100
@@ -10,7 +10,7 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = Failed password for invalid user ([0-9a-z][0-9a-z]?|([0-9a-z]){3}|ec2-user|postgres|postfix|ansible|oracle|nagios|git(olite?|blit|lab(_ci)?|[0-9]+)?|s?ftp(user|home|test)|hadoop|zabbix|student|ubuntu|teamspeak3?|ts3(serv(er)?|(music)?bot)?|jsboss|guest|(cs(go|cz)|mc)(server|srv)|minecraft|tomcat|applmgr|usuario|nexus|weblogic|vagrant|zimbra|jira|vyatta|qhsupport|cemergen|redmine|sinusbot|debian|asterisk|aptproxy|facebook|linode|kodi|mongodb|oraprod|proftpd|harvard|(www|web)-?(admin|run|user|data)|uuu|sshd[0-9]*|squid|write|rpc(user)?|WinD3str0y|sshusr|devteam|gmail|inssftp|master|(nfs)?nobody|daemon|squirrelmail|testing|testman|testftp|pgsql|sales[0-9]+|operator|(user|server)[0-9]+|amavisd?|software|download|pay_pal|desktop|opscode|noc|deploy|geniuz|steam(cmd)?|samba[0-9]*|screen|alumni|abc[0-9]*|operador|USERID|ggc_user|NpC|man|vhbackup|netdump|library|account[0-9]*|mysquel|(test)?username|pentaho|privoxy|abused|create|e-shop|uftp|comercial|danger|info|nasa|faxadmin|majordomo|db2adm|gdm|filter|mailer|www|sysadmin|PlcmSpIp(PlcmSpIp)?|coinadmin|amsftp|papernet|adm|webserver|fuser|chef|edu(cation)?|staffc|build|ventrilo) from <HOST> port [0-9]+ ssh2
+failregex = Failed password for invalid user ([0-9a-z][0-9a-z]?|([0-9a-z]){3}|abused|adm|admin[0-9]+|alumni|amavisd?|anonymous|ansible|aptproxy|asterisk|backup(s|user)|bitnami|bitrix|build|catchall|cemergen|chef|comercial|control|create|(cs(s|go|cz)|mc|tf2?|sdtd|web|pz)(server|srv)|daemon|danger|debian|deploy|desktop|devteam|django|download|easy|ec2-user|edu(cation)?|e-shop|facebook|filter|fuser|games|gdm|geniuz|ggc_user|git(olite?|blit|lab(_ci)?)?|gmail|guest|hadoop|harvard|huawei|info|jboss|jira|jsboss|kafka|kodi|library|linode|mailer|majordomo|man|master|minecraft|modem|mongodb|monitor|more|(my|pg)sq(ue)?l|nagios|nasa|netdump|nexus|(nfs)?nobody|noc|NpC|operador|operator|opscode|ora(cle|prod)|papernet|password|pay_?pal|pentaho|PlcmSpIp(PlcmSpIp)?|postfix|postgres|print|privoxy|qhsupport|rabbitmq|redmine|rpc(user)?|sales[0-9]+|(samba|sshd|git|student|tomcat|abc|web|(vpn|appl?)?(use?r|server|manager|mgr)|account)[0-9]*|screen|(s|u|ams|inss|pro)?ftp(d|user|home|test)?[0-9]*|sinusbot|socket|software|splunk|squid|squirrelmail|sshusr|staffc|steam(cmd)?|superuser|svnroot|system|teamspeak3?|test(ing|ftp|man|use?r)|(test)?username|tomcat|tools|ts3(serv(er)?|(music)?bot)?|ubnt|ubuntu|USERID|usuario|vagrant|ventrilo|vhbackup|vyatta|weblogic|WinD3str0y|write|www|(www|web|coin|fax|sys|db2)-?(adm(in)?|run|user|data)|zabbix|zimbra) from <HOST> port [0-9]+ ssh2
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.