5

What fail2ban regex would catch logs like these? 

Apr  9 08:48:28 server sshd[1856]: Received disconnect from 43.255.190.117: 11:  [preauth]
Apr  9 09:06:05 server sshd[1936]: Received disconnect from 43.255.191.159: 11:  [preauth]
Apr  9 09:06:10 server sshd[1938]: Received disconnect from 43.255.190.126: 11:  [preauth]
Apr  9 09:31:12 server sshd[2005]: Received disconnect from 43.255.190.123: 11:  [preauth]
Apr  9 09:37:06 server sshd[2013]: Received disconnect from 43.255.190.149: 11:  [preauth]
Apr  9 09:53:55 server sshd[2036]: Received disconnect from 43.255.190.149: 11:  [preauth]
Apr  9 10:16:59 server sshd[2368]: Received disconnect from 43.255.190.165: 11:  [preauth]
Apr  9 10:47:30 server sshd[3800]: Received disconnect from 43.255.190.150: 11:  [preauth]
Apr  9 11:04:01 server sshd[6855]: Received disconnect from 43.255.190.131: 11:  [preauth]

and/or with Bye Bye

Apr  9 12:29:59 server sshd[7764]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:00 server sshd[7766]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:01 server sshd[7768]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:03 server sshd[7776]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:04 server sshd[7778]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:05 server sshd[7780]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:06 server sshd[7782]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:07 server sshd[7784]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:08 server sshd[7786]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:10 server sshd[7788]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:11 server sshd[7790]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:12 server sshd[7792]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:13 server sshd[7794]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:14 server sshd[7796]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:15 server sshd[7798]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]
Apr  9 12:30:17 server sshd[7800]: Received disconnect from 180.210.234.87: 11: Bye Bye [preauth]

Whatever these folks are doing, I'd like a fail2ban rule for it. Apparently they aren't doing anything else to trip fail2ban, despite the frequency of the attempts.

JB0x2D1
  • 161
  • 1
  • 4

1 Answers1

14

You can use this rule:

^%(__prefix_line)sReceived disconnect from <HOST>: 11: (Bye Bye)? \[preauth\]$

To test it with fail2ban-regex or egrep, you can just strip off the ^%(__prefix_line)s from the beginning. Add this line to the failregex variable in your /etc/fail2ban/filter.d/sshd.conf.

A run with fail2ban-regex gave me these results, confirming that the rule matches:

Running tests
=============

Use regex file : sshd.conf
Use log file   : /var/log/auth.log


Results
=======

Failregex
|- Regular expressions:
[...]
|  [11] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*Received disconnect from <HOST>: 11: (Bye Bye)? \[preauth\]$
|
`- Number of matches:
[...]
   [11] 545 match(es)
[...]
sebix
  • 4,313
  • 2
  • 29
  • 47
  • On Amazon Linux I had to put this line: ^%(__prefix_line)sReceived disconnect from port .*:11: (Bye Bye)? \[preauth\]$ – Joris Mans May 05 '18 at 19:03