fail2ban/fail2ban — pull request #236 by kwirk (2013-05-27 21:19:26+00:00)
Title: sshd new regex for locked accounts

I've added an additional regex for sshd filter for locked accounts. I've noticed the number of log lines are ever increasing for this, as I've had over 4000 hits in the last six days, hence why I created the regex :smile:.

The `__prefix_line` contains the PID, which is therefore used to ensure that lines are tied together correctly.

```
Running tests
=============

Use regex file : /etc/fail2ban/filter.d/sshd.conf
Use maxlines : 10
Use systemd journal match: _COMM=sshd _BOOT_ID=7b79453acbe54c6ea0758613c74ac0ad

Results
=======

Failregex: 4648 total
|- #) [# of hits] regular expression
| 5) [607] ^\s*(<[^.]+\.[^.]+>)?\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s(?:\[ID \d+ \S+\])?\s*[iI](?:llegal|nvalid) user .* from \s*$
| 11) [26] ^\s*(<[^.]+\.[^.]+>)?\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s(?:\[ID \d+ \S+\])?\s*User .+ from not allowed because none of user's groups are listed in AllowGroups\s*$
| 12) [4015] ^(?P<__prefix>\s*(<[^.]+\.[^.]+>)?\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s(?:\[ID \d+ \S+\])?\s*)User .+ not allowed because account is locked(?P=__prefix)(?:error: )?Received disconnect from : 11: Bye Bye \[preauth\]$
`-
```