sshguard <2.1.0 doesn't match "Failed password for invalid user ..."

[Malcolm Scott]

I observe that sshguard 1.7.1-1 in bionic doesn't block SSH bruteforce attacks which are trying to log in as nonexistent accounts.

Whilst it blocks attacks which result in auth.log messages like:
  Jan 15 08:51:19 io sshd[18965]: Failed password for root from 223.223.200.14 port 48974 ssh2
it doesn't block attacks which result in:
  Jan 15 11:31:15 io sshd[11997]: Failed password for invalid user guest from 58.186.196.223 port 21715 ssh2

Matching log lines which include "invalid user" was added in sshguard 2.1.0 (https://sourceforge.net/p/sshguard/mailman/message/36109171/).

I consider this a security issue since sshguard is not performing its function -- it looks at first glance like it is working and it does block *some* attacks, but it misses the majority.

Could this or a later version be backported to bionic?

[Jason Stangroome (a-launchpad-7)]

This change in logging was introduced in OpenSSH 7.5 and explicitly noted in the "Potentially-incompatible changes" section of the release notes. Bionic has OpenSSH 7.6.

> The format of several log messages emitted by the packet code has
> changed to include additional information about the user and
> their authentication state. Software that monitors ssh/sshd logs
> may need to account for these changes. For example:

> Connection closed by user x 1.1.1.1 port 1234 [preauth]
> Connection closed by authenticating user x 10.1.1.1 port 1234 [preauth]
> Connection closed by invalid user x 1.1.1.1 port 1234 [preauth]

> Affected messages include connection closure, timeout, remote
> disconnection, negotiation failure and some other fatal messages
> generated by the packet code.

https://www.openssh.com/txt/release-7.5

[Jason Stangroome (a-launchpad-7)]

A very similar issue seems to have been addressed in sshguard 2.3 where "Failed publickey" logs with the key fingerprint at the end of the log line (as per Bionic's openssh 7.6 behavior) were not detected and therefore not blocked.

https://bitbucket.org/sshguard/sshguard/commits/cbf6332a3b21486136574e6968367f0bda293b5a

[Malcolm Scott (malcscott)]

sshguard in Ubuntu 18.04 is still largely nonfunctional. Is the relevant change likely to ever be backported to 18.04?