# Parser sshd for sshd "refused connect from" is missing per default

**URL:** <https://discourse.crowdsec.net/t/parser-sshd-for-sshd-refused-connect-from-is-missing-per-default/2180>\
**Category:** crowdsec\
**Created:** [December 11, 2024, 4:00pm UTC](https://discourse.crowdsec.net/t/parser-sshd-for-sshd-refused-connect-from-is-missing-per-default/2180 "2024-12-11T16:00:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![zoe](https://avatars.discourse-cdn.com/v4/letter/z/a4c791/32.png) [@zoe](https://discourse.crowdsec.net/u/zoe)\
**Post date:** [December 11, 2024, 4:00pm UTC](https://discourse.crowdsec.net/t/parser-sshd-for-sshd-refused-connect-from-is-missing-per-default/2180/1 "2024-12-11T16:00:54Z")

</div>

Migrating from fal2ban I found out that fail2ban blocks sshd-Attempts, but crowdsec does not.

The Debian system has /etc/hosts.allow and /hosts.deny  
fail2ban blocks hosts in the firewall which are denied by these files.  
fail2ban has default rules.  
This is the expected reaction.

My crowdsec uses default rules.  
After investigation the detail ist the following:

cscli explain --log “2024-12-10T05:22:17.372710+00:00 myhost sshd[12345]: refused connect from [foreign.host.com](http://foreign.host.com) (1.2.3.4)” --type syslog --debug

shows that the log line is ignored and any next steps of crowdsec will not happen.  
This is not the expected result and makes my crowdsec more unsave than my fal2ban.

Is there a default solution for this problem?

Thank you,  
Zoe

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [December 16, 2024, 11:37am UTC](https://discourse.crowdsec.net/t/parser-sshd-for-sshd-refused-connect-from-is-missing-per-default/2180/2 "2024-12-16T11:37:56Z")

</div>

Hey you are correct this is not handled by default, I just create a request to merge into the parser so the default collection will be able to parse these by default:

> <https://github.com/crowdsecurity/hub/pull/1192>
>
> ref: https://discourse.crowdsec.net/t/parser-sshd-for-sshd-refused-connect-from-…is-missing-per-default/2180

---

<div class="post-metadata">

**Author:** ![Cyrille37](https://avatars.discourse-cdn.com/v4/letter/c/90db22/32.png) [@Cyrille37](https://discourse.crowdsec.net/u/Cyrille37)\
**Post date:** [May 14, 2025, 9:43am UTC](https://discourse.crowdsec.net/t/parser-sshd-for-sshd-refused-connect-from-is-missing-per-default/2180/3 "2025-05-14T09:43:44Z")

</div>

Hi  
This feature has been merged [enhance: Add sshd refused connection based on hosts.deny by LaurenceJJones · Pull Request #1192 · crowdsecurity/hub · GitHub](https://github.com/crowdsecurity/hub/pull/1192#issuecomment-2879507607)

Thanks a lot for that really great tool and its community 🙂