On Tue, 16 Apr 2013, Daniel Black wrote:
>  >  failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$
>  > +            ^%(__prefix_line)sDid not receive identification string from <HOST>$

>    The lack of identification string isn't a (D)(DoS) related thing. Its the
>    absence of a client providing any SSH client identifier. I'm not sure why
>    any client would do this as the connection is aborted after this error.
>    Even so the absence of a client identifier is likely not to be a normal
>    client.

IIRC this messages came up before in the context of a flood of
them upon the server, diminishing its responsiveness and filling up the
logs.  Sounded like a DoS case to me -- thus this new filter/jail was
created.  

As for a normal client or not: seems could be attributed to the
problems with 

-  firewalls
http://communities.vmware.com/message/254166
- and VM configurations
  (could be just iptables again):
http://www.linuxquestions.org/questions/linux-server-73/server-problems-did-not-receive-identification-string-from-4175413412/

what I wonder though: is  this may be a sign of someone testing for some
known (?) vulnerability in some versions of sshd.

-- 
Yaroslav O. Halchenko
http://neuro.debian.net http://www.pymvpa.org http://www.fail2ban.org
Senior Research Associate,     Psychological and Brain Sciences Dept.
Dartmouth College, 419 Moore Hall, Hinman Box 6207, Hanover, NH 03755
Phone: +1 (603) 646-9834                       Fax: +1 (603) 646-1419
WWW:   http://www.linkedin.com/in/yarik