Regex for multiple sshd Received disconnect from ... [preauth]

Solution 1:

You can use this rule:

^%(__prefix_line)sReceived disconnect from <HOST>: 11: (Bye Bye)? \[preauth\]$

To test it with fail2ban-regex or egrep, you can just strip off the ^%(__prefix_line)s from the beginning. Add this line to the failregex variable in your /etc/fail2ban/filter.d/sshd.conf.

A run with fail2ban-regex gave me these results, confirming that the rule matches:

Running tests
=============

Use regex file : sshd.conf
Use log file   : /var/log/auth.log


Results
=======

Failregex
|- Regular expressions:
[...]
|  [11] ^\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*Received disconnect from <HOST>: 11: (Bye Bye)? \[preauth\]$
|
`- Number of matches:
[...]
   [11] 545 match(es)
[...]