# SPDX-License-Identifier: AGPL-3.0-only
# A failed password FOR ROOT specifically. root is a real account, so
# the line has no "invalid user" — a bot guessing root's password writes
# "Failed password for root from <ip>". On a correctly run server root
# either cannot log in over SSH at all or takes a key only: a password
# attempt on root is never a fat-fingered admin, it is an attack, and it
# earns a faster verdict than the general brute-force jail (Robin,
# 2026-08-20: "ban au 2e essai"). The general ssh rule counts it too.
parser: ssh-root-fail
log: ssh
prefilter: "Failed password for root from"
regex: '^(?P<time>\S+(?: +\d+ \d\d:\d\d:\d\d)?) \S+ sshd(?:-session)?\[\d+\]: Failed password for root from (?P<ip>\S+) port \d+ ssh2$'
time_field: time
time_format: rfc3339
