# Fail2ban filter for SSH DDoS attacks
# Deploy to: /etc/fail2ban/filter.d/sshd-ddos.conf
# Catches rapid connection attempts that may overwhelm SSH

[Definition]
failregex = ^%(__prefix_line)sConnection from <HOST> port \d+$
            ^%(__prefix_line)sConnection closed by <HOST> port \d+ \[preauth\]$
            ^%(__prefix_line)sDisconnected from <HOST> port \d+ \[preauth\]$

ignoreregex = 