{"action":"created","issue":{"url":"https://api.github.com/repos/fail2ban/fail2ban/issues/864","labels_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/864/labels{/name}","comments_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/864/comments","events_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/864/events","html_url":"https://github.com/fail2ban/fail2ban/issues/864","id":49954015,"number":864,"title":"ssh new rule to be added","user":{"login":"octavsly","id":818628,"avatar_url":"https://avatars.githubusercontent.com/u/818628?v=3","gravatar_id":"","url":"https://api.github.com/users/octavsly","html_url":"https://github.com/octavsly","followers_url":"https://api.github.com/users/octavsly/followers","following_url":"https://api.github.com/users/octavsly/following{/other_user}","gists_url":"https://api.github.com/users/octavsly/gists{/gist_id}","starred_url":"https://api.github.com/users/octavsly/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/octavsly/subscriptions","organizations_url":"https://api.github.com/users/octavsly/orgs","repos_url":"https://api.github.com/users/octavsly/repos","events_url":"https://api.github.com/users/octavsly/events{/privacy}","received_events_url":"https://api.github.com/users/octavsly/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":13,"created_at":"2014-11-24T22:55:19Z","updated_at":"2015-10-08T09:38:57Z","closed_at":"2015-10-08T09:38:57Z","body":"The following attack is not detected by fail2ban version 0.9.1 (gentoo)\r\n\r\n\r\n Nov 24 23:46:39 weurope sshd[32686]: SSH: Server;Ltype: Version;Remote: 121.199.22.83-1780;Protocol: 2.0;Client: libssh2_1.4.3\r\nNov 24 23:46:40 weurope sshd[32686]: SSH: Server;Ltype: Kex;Remote: 121.199.22.83-1780;Enc: aes128-ctr;MAC: hmac-sha1;Comp: none [preauth]\r\nNov 24 23:46:41 weurope sshd[32686]: SSH: Server;Ltype: Authname;Remote: 121.199.22.83-1780;Name: root [preauth]\r\nNov 24 23:46:43 weurope sshd[32686]: fatal: Read from socket failed: Connection reset by peer [preauth]\r\n\r\n\r\nTo detect it I did add in sshd.conf the following:\r\n^.*Remote: <HOST>-.*\\n.*fatal: Read from socket failed: Connection reset by peer \\[preauth\\]$\r\nThis needs to be changed to a proper/better regexp.\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/fail2ban/fail2ban/issues/comments/146473759","html_url":"https://github.com/fail2ban/fail2ban/issues/864#issuecomment-146473759","issue_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/864","id":146473759,"user":{"login":"octavsly","id":818628,"avatar_url":"https://avatars.githubusercontent.com/u/818628?v=3","gravatar_id":"","url":"https://api.github.com/users/octavsly","html_url":"https://github.com/octavsly","followers_url":"https://api.github.com/users/octavsly/followers","following_url":"https://api.github.com/users/octavsly/following{/other_user}","gists_url":"https://api.github.com/users/octavsly/gists{/gist_id}","starred_url":"https://api.github.com/users/octavsly/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/octavsly/subscriptions","organizations_url":"https://api.github.com/users/octavsly/orgs","repos_url":"https://api.github.com/users/octavsly/repos","events_url":"https://api.github.com/users/octavsly/events{/privacy}","received_events_url":"https://api.github.com/users/octavsly/received_events","type":"User","site_admin":false},"created_at":"2015-10-08T09:38:57Z","updated_at":"2015-10-08T09:38:57Z","body":"I have tested the patch with the code present at the beginning of the ticket, and it works. \r\nIt does match the HOST. \r\nThank you.\r\n"}}