Gecko [ www.thearyasamaj.org ]

Name	Size	Permission
ignorecommands	[ DIR ]	drwxr-xr-x
3proxy.conf	467 B	-rw-r--r--
apache-auth.conf	3.15 KB	-rw-r--r--
apache-badbots.conf	2.76 KB	-rw-r--r--
apache-botsearch.conf	1.24 KB	-rw-r--r--
apache-common.conf	1.58 KB	-rw-r--r--
apache-fakegooglebot.conf	324 B	-rw-r--r--
apache-modsecurity.conf	511 B	-rw-r--r--
apache-nohome.conf	596 B	-rw-r--r--
apache-noscript.conf	1.22 KB	-rw-r--r--
apache-overflows.conf	2.13 KB	-rw-r--r--
apache-pass.conf	362 B	-rw-r--r--
apache-shellshock.conf	1020 B	-rw-r--r--
assp.conf	3.41 KB	-rw-r--r--
asterisk.conf	2.31 KB	-rw-r--r--
bitwarden.conf	427 B	-rw-r--r--
botsearch-common.conf	522 B	-rw-r--r--
centreon.conf	307 B	-rw-r--r--
common.conf	2.71 KB	-rw-r--r--
counter-strike.conf	244 B	-rw-r--r--
courier-auth.conf	429 B	-rw-r--r--
courier-smtp.conf	512 B	-rw-r--r--
cyrus-imap.conf	444 B	-rw-r--r--
directadmin.conf	338 B	-rw-r--r--
domino-smtp.conf	2.06 KB	-rw-r--r--
dovecot.conf	2.4 KB	-rw-r--r--
dropbear.conf	1.69 KB	-rw-r--r--
drupal-auth.conf	557 B	-rw-r--r--
ejabberd-auth.conf	1.54 KB	-rw-r--r--
exim-common.conf	516 B	-rw-r--r--
exim-spam.conf	2.11 KB	-rw-r--r--
exim.conf	2.81 KB	-rw-r--r--
freeswitch.conf	1.88 KB	-rw-r--r--
froxlor-auth.conf	1.18 KB	-rw-r--r--
gitlab.conf	236 B	-rw-r--r--
grafana.conf	388 B	-rw-r--r--
groupoffice.conf	236 B	-rw-r--r--
gssftpd.conf	322 B	-rw-r--r--
guacamole.conf	1.41 KB	-rw-r--r--
haproxy-http-auth.conf	1.14 KB	-rw-r--r--
horde.conf	404 B	-rw-r--r--
kerio.conf	938 B	-rw-r--r--
lighttpd-auth.conf	333 B	-rw-r--r--
mongodb-auth.conf	2.23 KB	-rw-r--r--
monit.conf	787 B	-rw-r--r--
murmur.conf	927 B	-rw-r--r--
mysqld-auth.conf	953 B	-rw-r--r--
nagios.conf	400 B	-rw-r--r--
named-refused.conf	1.46 KB	-rw-r--r--
nginx-botsearch.conf	681 B	-rw-r--r--
nginx-http-auth.conf	485 B	-rw-r--r--
nginx-limit-req.conf	1.42 KB	-rw-r--r--
nsd.conf	760 B	-rw-r--r--
openhab.conf	452 B	-rw-r--r--
openwebmail.conf	495 B	-rw-r--r--
oracleims.conf	1.89 KB	-rw-r--r--
pam-generic.conf	947 B	-rw-r--r--
perdition.conf	568 B	-rw-r--r--
php-url-fopen.conf	891 B	-rw-r--r--
phpmyadmin-syslog.conf	278 B	-rw-r--r--
portsentry.conf	242 B	-rw-r--r--
postfix.conf	3.09 KB	-rw-r--r--
proftpd.conf	1.14 KB	-rw-r--r--
pure-ftpd.conf	2.35 KB	-rw-r--r--
qmail.conf	795 B	-rw-r--r--
recidive.conf	1.34 KB	-rw-r--r--
roundcube-auth.conf	1.46 KB	-rw-r--r--
screensharingd.conf	821 B	-rw-r--r--
selinux-common.conf	538 B	-rw-r--r--
selinux-ssh.conf	570 B	-rw-r--r--
sendmail-auth.conf	776 B	-rw-r--r--
sendmail-reject.conf	2.88 KB	-rw-r--r--
sieve.conf	371 B	-rw-r--r--
slapd.conf	706 B	-rw-r--r--
softethervpn.conf	451 B	-rw-r--r--
sogo-auth.conf	722 B	-rw-r--r--
solid-pop3d.conf	1.07 KB	-rw-r--r--
squid.conf	260 B	-rw-r--r--
squirrelmail.conf	191 B	-rw-r--r--
sshd.conf	7.34 KB	-rw-r--r--
stunnel.conf	363 B	-rw-r--r--
suhosin.conf	649 B	-rw-r--r--
tine20.conf	890 B	-rw-r--r--
traefik-auth.conf	2.33 KB	-rw-r--r--
uwimap-auth.conf	374 B	-rw-r--r--
vsftpd.conf	637 B	-rw-r--r--
webmin-auth.conf	444 B	-rw-r--r--
wuftpd.conf	520 B	-rw-r--r--
xinetd-fail.conf	521 B	-rw-r--r--
znc-adminlog.conf	912 B	-rw-r--r--
zoneminder.conf	524 B	-rw-r--r--

Code Editor : sshd.conf

# Fail2Ban filter for openssh
#
# If you want to protect OpenSSH from being bruteforced by password
# authentication then get public key authentication working before disabling
# PasswordAuthentication in sshd_config.
#
#
# "Connection from <HOST> port \d+" requires LogLevel VERBOSE in sshd_config
#

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[DEFAULT]

_daemon = sshd

# optional prefix (logged from several ssh versions) like "error: ", "error: PAM: " or "fatal: "
__pref = (?:(?:error|fatal): (?:PAM: )?)?
# optional suffix (logged from several ssh versions) like " [preauth]"
#__suff = (?: port \d+)?(?: \[preauth\])?\s*
__suff = (?: (?:port \d+|on \S+|\[preauth\])){0,3}\s*
__on_port_opt = (?: (?:port \d+|on \S+)){0,2}
# close by authenticating user:
__authng_user = (?: (?:invalid|authenticating) user <F-USER>\S+|.*?</F-USER>)?

# for all possible (also future) forms of "no matching (cipher|mac|MAC|compression method|key exchange method|host key type) found",
# see ssherr.c for all possible SSH_ERR_..._ALG_MATCH errors.
__alg_match = (?:(?:\w+ (?!found\b)){0,2}\w+)

# PAM authentication mechanism, can be overridden, e. g. `filter = sshd[__pam_auth='pam_ldap']`:
__pam_auth = pam_[a-z]+

[Definition]

prefregex = ^<F-MLFID>%(__prefix_line)s</F-MLFID>%(__pref)s<F-CONTENT>.+</F-CONTENT>$

cmnfailre = ^[aA]uthentication (?:failure|error|failed) for <F-USER>.*</F-USER> from <HOST>( via \S+)?%(__suff)s$
            ^User not known to the underlying authentication module for <F-USER>.*</F-USER> from <HOST>%(__suff)s$
            <cmnfailre-failed-pub-<publickey>>
            ^Failed <cmnfailed> for (?P<cond_inv>invalid user )?<F-USER>(?P<cond_user>\S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+)</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)
            ^<F-USER>ROOT</F-USER> LOGIN REFUSED FROM <HOST>
            ^[iI](?:llegal|nvalid) user <F-USER>.*?</F-USER> from <HOST>%(__suff)s$
            ^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because not listed in AllowUsers%(__suff)s$
            ^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because listed in DenyUsers%(__suff)s$
            ^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because not in any group%(__suff)s$
            ^refused connect from \S+ $<HOST>$
            ^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(__on_port_opt)s:\s*3: .*: Auth fail%(__suff)s$
            ^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because a group is listed in DenyGroups%(__suff)s$
            ^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because none of user's groups are listed in AllowGroups%(__suff)s$
            ^<F-NOFAIL>%(__pam_auth)s$sshd:auth$:\s+authentication failure;</F-NOFAIL>(?:\s+(?:(?:logname|e?uid|tty)=\S*)){0,4}\s+ruser=<F-ALT_USER>\S*</F-ALT_USER>\s+rhost=<HOST>(?:\s+user=<F-USER>\S*</F-USER>)?%(__suff)s$
            ^maximum authentication attempts exceeded for <F-USER>.*</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?%(__suff)s$
            ^User <F-USER>\S+|.*?</F-USER> not allowed because account is locked%(__suff)s
            ^<F-MLFFORGET>Disconnecting</F-MLFFORGET>(?: from)?(?: (?:invalid|authenticating)) user <F-USER>\S+</F-USER> <HOST>%(__on_port_opt)s:\s*Change of username or service not allowed:\s*.*\[preauth\]\s*$
            ^Disconnecting: Too many authentication failures(?: for <F-USER>\S+|.*?</F-USER>)?%(__suff)s$
            ^<F-NOFAIL>Received <F-MLFFORGET>disconnect</F-MLFFORGET></F-NOFAIL> from <HOST>%(__on_port_opt)s:\s*11:
            <mdre-<mode>-other>
            ^<F-MLFFORGET><F-MLFGAINED>Accepted \w+</F-MLFGAINED></F-MLFFORGET> for <F-USER>\S+</F-USER> from <HOST>(?:\s|$)

cmnfailed-any = \S+
cmnfailed-ignore = \b(?!publickey)\S+
cmnfailed-invalid = <cmnfailed-ignore>
cmnfailed-nofail = (?:<F-NOFAIL>publickey</F-NOFAIL>|\S+)
cmnfailed = <cmnfailed-<publickey>>

mdre-normal =
# used to differentiate "connection closed" with and without `[preauth]` (fail/nofail cases in ddos mode)
mdre-normal-other = ^<F-NOFAIL><F-MLFFORGET>(Connection closed|Disconnected)</F-MLFFORGET></F-NOFAIL> (?:by|from)%(__authng_user)s <HOST>(?:%(__suff)s|\s*)$

mdre-ddos = ^Did not receive identification string from <HOST>
            ^kex_exchange_identification: (?:[Cc]lient sent invalid protocol identifier|[Cc]onnection closed by remote host)
            ^Bad protocol version identification '.*' from <HOST>
            ^<F-NOFAIL>SSH: Server;Ltype:</F-NOFAIL> (?:Authname|Version|Kex);Remote: <HOST>-\d+;[A-Z]\w+:
            ^Read from socket failed: Connection <F-MLFFORGET>reset</F-MLFFORGET> by peer
# same as mdre-normal-other, but as failure (without <F-NOFAIL>) and [preauth] only:
mdre-ddos-other = ^<F-MLFFORGET>(Connection (?:closed|reset)|Disconnected)</F-MLFFORGET> (?:by|from)%(__authng_user)s <HOST>%(__on_port_opt)s\s+\[preauth\]\s*$

mdre-extra = ^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(__on_port_opt)s:\s*14: No(?: supported)? authentication methods available
            ^Unable to negotiate with <HOST>%(__on_port_opt)s: no matching <__alg_match> found.
            ^Unable to negotiate a <__alg_match>
            ^no matching <__alg_match> found:
# part of mdre-ddos-other, but user name is supplied (invalid/authenticating) on [preauth] phase only:
mdre-extra-other = ^<F-MLFFORGET>Disconnected</F-MLFFORGET>(?: from)?(?: (?:invalid|authenticating)) user <F-USER>\S+|.*?</F-USER> <HOST>%(__on_port_opt)s \[preauth\]\s*$

mdre-aggressive = %(mdre-ddos)s
                  %(mdre-extra)s
# mdre-extra-other is fully included within mdre-ddos-other:
mdre-aggressive-other = %(mdre-ddos-other)s

# Parameter "publickey": nofail (default), invalid, any, ignore
publickey = nofail
# consider failed publickey for invalid users only:
cmnfailre-failed-pub-invalid = ^Failed publickey for invalid user <F-USER>(?P<cond_user>\S+)|(?:(?! from ).)*?</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)
# consider failed publickey for valid users too (don't need RE, see cmnfailed):
cmnfailre-failed-pub-any =
# same as invalid, but consider failed publickey for valid users too, just as no failure (helper to get IP and user-name only, see cmnfailed):
cmnfailre-failed-pub-nofail = <cmnfailre-failed-pub-invalid>
# don't consider failed publickey as failures (don't need RE, see cmnfailed):
cmnfailre-failed-pub-ignore =

cfooterre = ^<F-NOFAIL>Connection from</F-NOFAIL> <HOST>

failregex = %(cmnfailre)s
            <mdre-<mode>>
            %(cfooterre)s

# Parameter "mode": normal (default), ddos, extra or aggressive (combines all)
# Usage example (for jail.local):
#   [sshd]
#   mode = extra
#   # or another jail (rewrite filter parameters of jail):
#   [sshd-aggressive]
#   filter = sshd[mode=aggressive]
#
mode = normal

#filter = sshd[mode=aggressive]

ignoreregex =

maxlines = 1

journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=sshd

# DEV Notes:
#
#   "Failed \S+ for .*? from <HOST>..." failregex uses non-greedy catch-all because
#   it is coming before use of <HOST> which is not hard-anchored at the end as well,
#   and later catch-all's could contain user-provided input, which need to be greedily
#   matched away first.
#
# Author: Cyril Jaquier, Yaroslav Halchenko, Petr Voralek, Daniel Black and Sergey Brester aka sebres
# Rewritten using prefregex (and introduced "mode" parameter) by Serg G. Brester.

${this.title}

Code Editor : sshd.conf