# SPDX-License-Identifier: AGPL-3.0-only
# A connection held open without authenticating until sshd gave up:
#   fatal: Timeout before authentication for 203.0.113.9 port 22
#
# The signature of a regreSSHion (CVE-2024-6387) attempt, which needs
# thousands of them, and of nothing a client does on purpose.
parser: ssh-auth-timeout
log: ssh
prefilter: "Timeout before authentication"
regex: '^(?P<time>\S+(?: +\d+ \d\d:\d\d:\d\d)?) \S+ sshd(?:-session)?\[\d+\]: .*Timeout before authentication for (?P<ip>[0-9a-fA-F.:]+) port \d+$'
time_field: time
time_format: rfc3339
