# SPDX-License-Identifier: AGPL-3.0-only
# A root attempt that ended at preauth — "Connection closed/reset by
# authenticating user root", "Disconnected from authenticating user
# root". On a key-only host (no password accepted) this is the ONLY
# trace a bot guessing root leaves: no "Failed password" is ever
# written. root over SSH is never a legitimate password client, so this
# counts toward the two-strike root jail exactly like a failed password
# (Robin, 2026-08-20: the preauth lines were being missed). "root"
# exactly — a username like "root2" reads as its own name, not this.
parser: ssh-root-preauth
log: ssh
prefilter: "authenticating user root"
regex: '^(?P<time>\S+(?: +\d+ \d\d:\d\d:\d\d)?) \S+ sshd(?:-session)?\[\d+\]: (?:Connection closed by|Connection reset by|Disconnected from) authenticating user root (?P<ip>[0-9a-fA-F.:]+) port \d+ \[preauth\]$'
time_field: time
time_format: rfc3339
