ssh-root Free

Guessing root's SSH password — root never logs in with a password here, so one failure is the whole proof; one and out

Category

ssh

Threshold

1/10m

Ban policy

ssh

Report

ssh-brute-force

Parsers

ssh-root-fail ssh-root-preauth

Why it is written this way

The rule file View raw

# Guessing root's password: ONE failure and out. root over SSH is
# disabled or key-only on any server run properly, so a password attempt
# on it is always an attack, never an administrator's slip — it does not
# get the general jail's patience (Robin, 2026-08-20). Both the failed
# password AND the preauth abort count: on a key-only host the bot never
# reaches a password prompt, and "Connection closed by authenticating
# user root [preauth]" is the whole of what it leaves. The ssh rule
# counts these lines too; this one only bans sooner.
rule: ssh-root
description: "Guessing root's SSH password — root never logs in with a password here, so one failure is the whole proof; one and out"
about:
  purpose: >-
    Ban outright whoever tries to log in as root, without the patience the general SSH rule shows.
  blocks: >-
    One refused login for root — a wrong password, or the abort a bot leaves on a key-only host (`Connection closed by authenticating user root [preauth]`).
  applies_to: >-
    Any machine where root does not log in over SSH with a password, which is every machine run properly.
  requires:
    - >-
      sshd's own log, declared as `log: ssh` — /var/log/auth.log on Debian and Ubuntu, /var/log/secure on RHEL and its family.
    - >-
      root either refused or key-only (`PermitRootLogin no` or `prohibit-password`). Where root logs in with a password, this rule would ban your own administrator.
  beware:
    - >-
      Nothing, if the prerequisite holds. If a script somewhere still logs in as root with a password, it will be banned on its first typo.
category: ssh
parsers:
  - ssh-root-fail
  - ssh-root-preauth
# One attempt is never an administrator: nobody has to log in as root
# and fail (Robin, 2026-09-07). Was [2/10m, 3/24h] — the patient bots
# striking once a day walked through.
threshold: 1/10m
ban: ssh
report: ssh-brute-force