Not matched: "sshd[...]: Failed password for invalid user... "

[Former user]

On Debian/Wheezy (openssh 6.0) and Debian/Jessie (openssh 6.7) openssh logs "Failed password for invalid user... " instead of just "Invalid user... " which does not seem to get matched (checked 1.7 and 2.0). Here are some example log lines from auth.log:

Mar 26 23:57:25 vst01 sshd[29787]: Failed password for invalid user admin from 190.40.143.151 port 39065 ssh2 Mar 26 23:57:28 vst01 sshd[29787]: Failed password for invalid user admin from 190.40.143.151 port 39065 ssh2 Mar 26 23:57:30 vst01 sshd[29787]: Failed password for invalid user admin from 190.40.143.151 port 39065 ssh2 Mar 26 23:57:32 vst01 sshd[29787]: Failed password for invalid user admin from 190.40.143.151 port 39065 ssh2 Mar 26 23:57:34 vst01 sshd[29787]: Failed password for invalid user admin from 190.40.143.151 port 39065 ssh2

[Daniel Aleksandersen]

Thank you for the report!

Fixed by commit 6c6d071.