# SPDX-License-Identifier: AGPL-3.0-only
# A password refused, for a real account or an invented one:
#   Failed password for root from 203.0.113.9 port 51266 ssh2
#   Failed password for invalid user admin from 203.0.113.9 port 51266 ssh2
#
# The username is chosen by whoever is connecting and may contain
# spaces, so the pattern is anchored at the end of the line and lets the
# username run greedily: " from <address> port <n> ssh2" then binds to
# the last one on the line, which is the one sshd wrote. Without that, a
# user called "x from 198.51.100.1 port 22 ssh2" gets someone else
# banned.
parser: ssh-auth-fail
log: ssh
prefilter: "Failed password"
regex: '^(?P<time>\S+(?: +\d+ \d\d:\d\d:\d\d)?) \S+ sshd(?:-session)?\[\d+\]: Failed password for (?:invalid user )?(?P<user>.*) from (?P<ip>\S+) port \d+ ssh2$'
time_field: time
time_format: rfc3339
