{"action":"opened","issue":{"url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1402","repository_url":"https://api.github.com/repos/fail2ban/fail2ban","labels_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1402/labels{/name}","comments_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1402/comments","events_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1402/events","html_url":"https://github.com/fail2ban/fail2ban/issues/1402","id":151732282,"number":1402,"title":"Feature Suggestion: expanded docs for sshd integration and additional jails","user":{"login":"jvanasco","id":204779,"avatar_url":"https://avatars.githubusercontent.com/u/204779?v=3","gravatar_id":"","url":"https://api.github.com/users/jvanasco","html_url":"https://github.com/jvanasco","followers_url":"https://api.github.com/users/jvanasco/followers","following_url":"https://api.github.com/users/jvanasco/following{/other_user}","gists_url":"https://api.github.com/users/jvanasco/gists{/gist_id}","starred_url":"https://api.github.com/users/jvanasco/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvanasco/subscriptions","organizations_url":"https://api.github.com/users/jvanasco/orgs","repos_url":"https://api.github.com/users/jvanasco/repos","events_url":"https://api.github.com/users/jvanasco/events{/privacy}","received_events_url":"https://api.github.com/users/jvanasco/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-04-28T20:11:58Z","updated_at":"2016-04-28T20:11:58Z","closed_at":null,"body":"I've had a handful of botnets target a machine and found some deficiencies with the default setups (in source and the ubuntu16.04 package)\r\n\r\nI'd like to make a few suggestions for docs to educate users, and suggest some additional jails for situations that suggest the connecting IP is not legitimate and should be treated more harshly than the standard sshd jail:\r\n\r\n1. The sshd jail really depends on how sshd is configured, especially in terms of the loglevel and max retries.  on many system defaults, an attacker can provide 3 invalid passwords during a single logged sshd attempt.  this means max retries of 3 in fail2ban could really be 9 password attempts.\r\n\r\n2. If loglevel on sshd is set to VERBOSE, one can catch invalid users and block differently.  botnets seem to test for accounts like \"ubuntu@\" ,  \"redhat@\", \"sysadmin@\" .  \r\n\r\n    failregex = ^%(__prefix_line)sInvalid user .+ from <HOST>(?: port \\d*)?$\r\n\r\n3. botnets also seem to favor certain \"system accounts\" and try to login as them\r\n\r\n    failregex = ^%(__prefix_line)sFailed (?:password|publickey) for (?:root|redis|postfix|apache) from <HOST>(?: port \\d*)?(?: ssh\\d*)?$\r\n\r\n4. If the sshd config blocks password access to a server, the loglevel will decide whether or not this info is logged; so ips trying to `ssh root@example.com` might never get seen by fail2ban.\r\n\r\nI don't know how this could be handled, but fail2ban should really make some recommendations on sshd logging and how to ensure certain types of login attempts are handled.\r\n\r\n"}}