changeset 209:098cd85795f6 puppet-3.6

Blacklist three identical characters e.g. www, qqq, 777
author IBBoard <dev@ibboard.co.uk>
date Sat, 29 Jun 2019 14:02:07 +0100
parents 2db41da29948
children c361ebbf07e4
files common/fail2ban/ibb-sshd-bad-user.conf
diffstat 1 files changed, 1 insertions(+), 1 deletions(-) [+]
line diff
     1.1 --- a/common/fail2ban/ibb-sshd-bad-user.conf	Wed Jun 26 20:32:42 2019 +0100
     1.2 +++ b/common/fail2ban/ibb-sshd-bad-user.conf	Sat Jun 29 14:02:07 2019 +0100
     1.3 @@ -10,7 +10,7 @@
     1.4  #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
     1.5  # Values:  TEXT
     1.6  #
     1.7 -failregex = Failed password for invalid user ([0-9a-z][0-9a-z]?|ec2-user|postgres|postfix|ansible|oracle|nagios|git(olite?|blit|lab(_ci)?|[0-9]+)?|s?ftp(user|home|test)|hadoop|zabbix|student|ubuntu|teamspeak3?|ts3(serv(er)?|(music)?bot)?|jsboss|guest|(cs(go|cz)|mc)(server|srv)|minecraft|tomcat|applmgr|usuario|nexus|weblogic|vagrant|zimbra|jira|vyatta|qhsupport|cemergen|redmine|sinusbot|debian|asterisk|aptproxy|facebook|linode|kodi|mongodb|oraprod|proftpd|harvard|(www|web)-?(admin|run|user|data)|uuu|sshd[0-9]*|squid|write|rpc(user)?|WinD3str0y|sshusr|devteam|gmail|inssftp|master|(nfs)?nobody|daemon|squirrelmail|testing|testman|testftp|pgsql|sales[0-9]+|operator|(user|server)[0-9]+|amavisd?|software|download|pay_pal|desktop|opscode|noc|deploy|geniuz|steam(cmd)?|samba[0-9]*|screen|alumni|abc[0-9]*|operador|USERID|ggc_user|NpC|man|vhbackup|netdump|library|account[0-9]*|mysquel|(test)?username|pentaho|privoxy|abused|create|e-shop|uftp|comercial|danger|info|nasa|faxadmin|majordomo|db2adm|gdm|filter|mailer|www|sysadmin|PlcmSpIp(PlcmSpIp)?|coinadmin|amsftp|papernet|adm|webserver|fuser|chef|edu(cation)?|staffc|build|ventrilo) from <HOST> port [0-9]+ ssh2
     1.8 +failregex = Failed password for invalid user ([0-9a-z][0-9a-z]?|[0-9a-z]{3,}|ec2-user|postgres|postfix|ansible|oracle|nagios|git(olite?|blit|lab(_ci)?|[0-9]+)?|s?ftp(user|home|test)|hadoop|zabbix|student|ubuntu|teamspeak3?|ts3(serv(er)?|(music)?bot)?|jsboss|guest|(cs(go|cz)|mc)(server|srv)|minecraft|tomcat|applmgr|usuario|nexus|weblogic|vagrant|zimbra|jira|vyatta|qhsupport|cemergen|redmine|sinusbot|debian|asterisk|aptproxy|facebook|linode|kodi|mongodb|oraprod|proftpd|harvard|(www|web)-?(admin|run|user|data)|uuu|sshd[0-9]*|squid|write|rpc(user)?|WinD3str0y|sshusr|devteam|gmail|inssftp|master|(nfs)?nobody|daemon|squirrelmail|testing|testman|testftp|pgsql|sales[0-9]+|operator|(user|server)[0-9]+|amavisd?|software|download|pay_pal|desktop|opscode|noc|deploy|geniuz|steam(cmd)?|samba[0-9]*|screen|alumni|abc[0-9]*|operador|USERID|ggc_user|NpC|man|vhbackup|netdump|library|account[0-9]*|mysquel|(test)?username|pentaho|privoxy|abused|create|e-shop|uftp|comercial|danger|info|nasa|faxadmin|majordomo|db2adm|gdm|filter|mailer|www|sysadmin|PlcmSpIp(PlcmSpIp)?|coinadmin|amsftp|papernet|adm|webserver|fuser|chef|edu(cation)?|staffc|build|ventrilo) from <HOST> port [0-9]+ ssh2
     1.9  
    1.10  # Option:  ignoreregex
    1.11  # Notes.:  regex to ignore. If this regex matches, the line is ignored.