# SPDX-License-Identifier: AGPL-3.0-only
# An authentication that was under way for a NAMED account when the
# client gave up:
#   Connection closed by authenticating user root 203.0.113.9 port 56390 [preauth]
#   Disconnected from invalid user vlad 203.0.113.9 port 57134 [preauth]
#
# This is a login attempt. sshd only writes "authenticating user X" once
# a client has offered an account and the exchange has begun, so the
# connection was not a port scan and not a monitor: someone tried, and
# stopped when they did not get in. On a key-only host they were never
# going to.
#
# Worth the same as a refused password, and the reason this parser
# exists at all: it used to be folded into ssh-preauth-abort, where the
# weight had to suit a bare dropped connection, and a real bot working
# through root then scored one point out of five and walked. Keeping
# the named-account lines apart is what lets each carry its own weight.
#
# The account name is chosen by the client, so the pattern is anchored
# at the end of the line and lets it run greedily: " <address> port <n>
# [preauth]" then binds to the last one on the line, which is sshd's.
parser: ssh-auth-abandoned
log: ssh
prefilter: "[preauth]"
regex: '^(?P<time>\S+(?: +\d+ \d\d:\d\d:\d\d)?) \S+ sshd(?:-session)?\[\d+\]: (?:Connection closed by|Connection reset by|Disconnected from) (?:authenticating user|invalid user) (?P<user>.*) (?P<ip>[0-9a-fA-F.:]+) port \d+ \[preauth\]$'
time_field: time
time_format: rfc3339
