6

What fail2ban regex would catch logs like these?

Apr  9 08:48:28 server sshd[1856]: Received disconnect from 43.255.190.117: 11:  [preauth]
Apr  9 09:06:05 server sshd[1936]: Received disconnect from 43.255.191.159: 11:  [preauth]
Apr  9 09:06:10 server sshd[1938]: Received disconnect from 43.255.190.126: 11:  [preauth]
Apr  9 09:31:12 server sshd[2005]: Received disconnect from 43.255.190.123: 11:  [preauth]
Apr  9 09:37:06 server sshd[2013]: Received disconnect from 43.255.190.149: 11:  [preauth]
Apr  9 09:53:55 server sshd[2036]: Received disconnect from 43.255.190.149: 11:  [preauth]
Apr  9 10:16:59 server sshd[2368]: Received disconnect from 43.255.190.165: 11:  [preauth]
Apr  9 10:47:30 server sshd[3800]: Received disconnect from 43.255.190.150: 11:  [preauth]
Apr  9 11:04:01 server sshd[6855]: Received disconnect from 43.255.190.131: 11:  [preauth]

and/or with Bye Bye

Apr  9 12:29:59 server sshd[7764]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:00 server sshd[7766]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:01 server sshd[7768]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:03 server sshd[7776]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:04 server sshd[7778]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:05 server sshd[7780]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:06 server sshd[7782]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:07 server sshd[7784]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:08 server sshd[7786]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:10 server sshd[7788]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:11 server sshd[7790]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:12 server sshd[7792]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:13 server sshd[7794]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:14 server sshd[7796]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:15 server sshd[7798]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:17 server sshd[7800]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]

Whatever these folks are doing, I'd like a fail2ban rule for it. Apparently they aren't doing anything else to trip fail2ban, despite the frequency of the attempts.

14

You can use this rule:

^%(__prefix_line)sReceived disconnect from <HOST>: 11: (Bye Bye)? \[preauth\]$

To test it with fail2ban-regex or egrep, you can just strip off the ^%(__prefix_line)s from the beginning. Add this line to the failregex variable in your /etc/fail2ban/filter.d/sshd.conf.

A run with fail2ban-regex gave me these results, confirming that the rule matches:

Running tests
=============

Use regex file : sshd.conf
Use log file   : /var/log/auth.log


Results
=======

Failregex
|- Regular expressions:
[...]
|  [11] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*Received disconnect from <HOST>: 11: (Bye Bye)? \[preauth\]$
|
`- Number of matches:
[...]
   [11] 545 match(es)
[...]
| improve this answer | |
  • On Amazon Linux I had to put this line: ^%(__prefix_line)sReceived disconnect from <HOST> port .*:11: (Bye Bye)? [preauth]$ – Joris Mans May 5 '18 at 19:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.