Added another Windows OpenSSH sshd selector to the default configurat…

…ion file for "Invalid user" error, in addition to the existing "Failed password" selector
Aldaviva · Aug 24, 2023 · 0bf748f · 0bf748f
1 parent c3203bb
commit 0bf748f
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/Fail2Ban4Win/configuration.json b/Fail2Ban4Win/configuration.json
@@ -27,6 +27,11 @@
  "eventId": 4,
  "ipAddressEventDataName": "payload",
  "ipAddressPattern": "^Failed password for(?: invalid user)? .+ from (?<ipAddress>(?:\\d{1,3}\\.){3}\\d{1,3}) port \\d{1,5} ssh\\d?$"
+ }, {
+ "logName": "OpenSSH/Operational",
+ "eventId": 4,
+ "ipAddressEventDataName": "payload",
+ "ipAddressPattern": "^Invalid user .+ from (?<ipAddress>(?:\\d{1,3}\\.){3}\\d{1,3}) port \\d{1,5}$"
  }
  ]
-}
+}