ideally we should have failregex'es anchored at the end (check other filters, e.g. for ssh) to prevent injection within username fields