# HG changeset patch
# User IBBoard <dev@ibboard.co.uk>
# Date 1561213399 -3600
# Node ID 2f72fc5c4441519addb7dd874724422d44ed1554
# Parent  98192391be03d9c88adade0abcb286c5d38e3900
Blacklist a load of new probed usernames

diff -r 98192391be03 -r 2f72fc5c4441 common/fail2ban/ibb-sshd-bad-user.conf
--- a/common/fail2ban/ibb-sshd-bad-user.conf	Sat Jun 08 13:37:19 2019 +0100
+++ b/common/fail2ban/ibb-sshd-bad-user.conf	Sat Jun 22 15:23:19 2019 +0100
@@ -10,7 +10,7 @@
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
 #
-failregex = Failed password for invalid user ([0-9a-z][0-9a-z]?|ec2-user|postgres|postfix|ansible|oracle|nagios|git(olit|lab)?|s?ftp(user|home)|hadoop|zabbix|student|ubuntu|teamspeak3?|ts3(server|bot)?|jsboss|guest|csgo(server|srv)|minecraft|tomcat|applmgr|usuario|nexus|weblogic|vagrant|zimbra|jira|vyatta|qhsupport|cemergen|redmine|sinusbot|debian|asterisk|aptproxy|facebook|linode|kodi|mongodb|oraprod|proftpd|weblogic|harvard|www-?(admin|run|user|data)|uuu|sshd[0-9]*|squid|write|rpcuser|WinD3str0y|sshusr|devteam|gmail|inssftp|master|(nfs)?nobody|daemon|squirrelmail|testing|testman|pgsql|sales[0-9]+|operator|(user|server)[0-9]+|amavis|software|download|pay_pal|desktop|opscode|noc|deploy|geniuz|steam|samba[0-9]*|screen|alumni|abc[0-9]*|operador|USERID|ggc_user|NpC|man|vhbackup|netdump|library|account[0-9]*|mysquel|username|pentaho|privoxy|abused|create|e-shop|uftp|comercial) from <HOST> port [0-9]+ ssh2
+failregex = Failed password for invalid user ([0-9a-z][0-9a-z]?|ec2-user|postgres|postfix|ansible|oracle|nagios|git(olite?|blit|lab(_ci)?)?|s?ftp(user|home)|hadoop|zabbix|student|ubuntu|teamspeak3?|ts3(server|(music)?bot)?|jsboss|guest|csgo(server|srv)|minecraft|tomcat|applmgr|usuario|nexus|weblogic|vagrant|zimbra|jira|vyatta|qhsupport|cemergen|redmine|sinusbot|debian|asterisk|aptproxy|facebook|linode|kodi|mongodb|oraprod|proftpd|harvard|(www|web)-?(admin|run|user|data)|uuu|sshd[0-9]*|squid|write|rpc(user)?|WinD3str0y|sshusr|devteam|gmail|inssftp|master|(nfs)?nobody|daemon|squirrelmail|testing|testman|testftp|pgsql|sales[0-9]+|operator|(user|server)[0-9]+|amavis|software|download|pay_pal|desktop|opscode|noc|deploy|geniuz|steam(cmd)?|samba[0-9]*|screen|alumni|abc[0-9]*|operador|USERID|ggc_user|NpC|man|vhbackup|netdump|library|account[0-9]*|mysquel|username|pentaho|privoxy|abused|create|e-shop|uftp|comercial|danger|info|nasa|faxadmin|majordomo|db2adm|gdm|filter|mailer|www|sysadmin|PlcmSpIp(PlcmSpIp)?|coinadmin|gitblit|amsftp|papernet) from <HOST> port [0-9]+ ssh2
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.