ssh-common-user Gratuit

An SSH password tried for a common account name that does not exist here (admin, test, oracle…) — the signature of a bot's wordlist; one and out

Catégorie

ssh

Seuil

1/10m

Politique de ban

exploit

Signalement

ssh-brute-force

Parseurs

inline inline

Pourquoi elle est écrite ainsi

Le fichier de la règle Voir le brut

# A password tried for a user that does NOT exist and is one of the
# names every dictionary opens with — admin, test, ubuntu, oracle,
# postgres, git, deploy… Only the INVALID form counts ("Failed password
# for invalid user admin", or the preauth close "by invalid user
# admin"): a real account named admin fumbling its password is ssh's
# business, at ssh's pace; a name that is not on the machine is a list
# being read, and the first one convicts (Robin, 2026-09-07: like
# ssh-root, the strongest severity). root itself is ssh-root's.
rule: ssh-common-user
description: "An SSH password tried for a common account name that does not exist here (admin, test, oracle…) — the signature of a bot's wordlist; one and out"
about:
  purpose: >-
    Ban the dictionary at its first word, instead of waiting for it to work through the list.
  blocks: >-
    One password tried for a user that does not exist on the machine and is one of the names every dictionary opens with — admin, test, ubuntu, oracle, postgres, git, deploy.
  applies_to: >-
    Any machine running OpenSSH.
  requires:
    - >-
      sshd's own log, declared as `log: ssh` — /var/log/auth.log on Debian and Ubuntu, /var/log/secure on RHEL and its family.
  beware:
    - >-
      Only the INVALID form counts: a real account named admin fumbling its own password is the general SSH rule's business, at its pace. Create an account with one of those names and this rule stops watching it.
category: ssh
log: ssh
time_field: time
time_format: rfc3339
parsers:
  - regex: '^(?P<time>\S+(?: +\d+ \d\d:\d\d:\d\d)?) \S+ sshd(?:-session)?\[\d+\]: Failed password for invalid user (?P<user>(?i:admin|administrator|superadmin|sysadmin|operator|test|test1|test2|testuser|user|user1|guest|demo|temp|default|service|server|support|ubuntu|debian|centos|fedora|alpine|ec2-user|vagrant|pi|oracle|postgres|postgresql|mysql|mariadb|redis|mongo|mongodb|elastic|elasticsearch|kafka|hadoop|www|www-data|apache|nginx|tomcat|jenkins|gitlab|git|svn|nagios|zabbix|ansible|deploy|deployer|dev|developer|devops|docker|k8s|kubernetes|backup|ftp|ftpuser|sftp|mail|postfix|vpn|openvpn|minecraft|steam|teamspeak|ts3|plex|odoo|wordpress|cisco|ubnt|nvidia|ali|alibaba|azureuser|es|hive|spark)) from (?P<ip>\S+) port \d+ ssh2$'
    prefilter: Failed password for invalid user
  - regex: '^(?P<time>\S+(?: +\d+ \d\d:\d\d:\d\d)?) \S+ sshd(?:-session)?\[\d+\]: (?:Connection closed by|Connection reset by|Disconnected from) invalid user (?P<user>(?i:admin|administrator|superadmin|sysadmin|operator|test|test1|test2|testuser|user|user1|guest|demo|temp|default|service|server|support|ubuntu|debian|centos|fedora|alpine|ec2-user|vagrant|pi|oracle|postgres|postgresql|mysql|mariadb|redis|mongo|mongodb|elastic|elasticsearch|kafka|hadoop|www|www-data|apache|nginx|tomcat|jenkins|gitlab|git|svn|nagios|zabbix|ansible|deploy|deployer|dev|developer|devops|docker|k8s|kubernetes|backup|ftp|ftpuser|sftp|mail|postfix|vpn|openvpn|minecraft|steam|teamspeak|ts3|plex|odoo|wordpress|cisco|ubnt|nvidia|ali|alibaba|azureuser|es|hive|spark)) (?P<ip>[0-9a-fA-F.:]+) port \d+ \[preauth\]$'
    prefilter: invalid user
threshold: 1/10m
ban: exploit
report: ssh-brute-force