Shieldlist

ssh-root Free

Guessing root's SSH password — two failures and out

Category
ssh
Threshold
2/10m
Ban policy
ssh
Report
ssh-brute-force
Parsers
ssh-root-fail ssh-root-preauth

Why it is written this way

Guessing root's password: two failures and out. root over SSH is
disabled or key-only on any server run properly, so a password attempt
on it is always an attack, never an administrator's slip — it does not
get the general jail's patience (Robin, 2026-08-20). Both the failed
password AND the preauth abort count: on a key-only host the bot never
reaches a password prompt, and "Connection closed by authenticating
user root [preauth]" is the whole of what it leaves. The ssh rule
counts these lines too; this one only bans sooner.

The rule file View raw

# Guessing root's password: two failures and out. root over SSH is
# disabled or key-only on any server run properly, so a password attempt
# on it is always an attack, never an administrator's slip — it does not
# get the general jail's patience (Robin, 2026-08-20). Both the failed
# password AND the preauth abort count: on a key-only host the bot never
# reaches a password prompt, and "Connection closed by authenticating
# user root [preauth]" is the whole of what it leaves. The ssh rule
# counts these lines too; this one only bans sooner.
rule: ssh-root
description: "Guessing root's SSH password — two failures and out"
category: ssh
parsers:
  - ssh-root-fail
  - ssh-root-preauth
threshold: 2/10m
ban: ssh
report: ssh-brute-force