Blame SOURCES/logwatch-sshd-format.patch
|
 |
809a25 |
Resolves: #1422797
|
|
|
809a25 |
|
|
|
809a25 |
--- a/scripts/services/sshd 2017-08-28 13:11:02.078000000 +0200
|
|
|
809a25 |
+++ b/scripts/services/sshd 2017-08-28 13:38:22.097000000 +0200
|
|
|
809a25 |
@@ -290,7 +290,9 @@
|
|
|
809a25 |
($ThisLine =~ /^Failed keyboard-interactive for <invalid username> from/ ) or
|
|
|
809a25 |
($ThisLine =~ /^Keyboard-interactive \(PAM\) userauth failed/ ) or
|
|
|
809a25 |
($ThisLine =~ /^debug1: /) or
|
|
|
809a25 |
- ($ThisLine =~ /Nasty PTR record .* is set up for [\da-fA-F.:]+, ignoring/)
|
|
|
809a25 |
+ ($ThisLine =~ /Nasty PTR record .* is set up for [\da-fA-F.:]+, ignoring/) or
|
|
|
809a25 |
+ ($ThisLine =~ /Exiting on signal .*$/) or
|
|
|
809a25 |
+ ($ThisLine =~ /Disconnected from (?:[^ ]*) port .*$/)
|
|
|
809a25 |
) {
|
|
|
809a25 |
# Ignore these
|
|
|
809a25 |
} elsif ( my ($Method,$User,$Host,$Port) = ($ThisLine =~ /^Accepted (\S+) for (\S+) from ([\d\.:a-f]+) port (\d+)/) ) {
|
|
|
809a25 |
@@ -379,7 +381,9 @@
|
|
|
809a25 |
$RefusedConnections{$1}++;
|
|
|
809a25 |
} elsif ( my ($Reason) = ($ThisLine =~ /^Authentication refused: (.*)$/ ) ) {
|
|
|
809a25 |
$RefusedAuthentication{$Reason}++;
|
|
|
809a25 |
- } elsif ( my ($Host,$Reason) = ($ThisLine =~ /^Received disconnect from ([^ ]*): (.*)$/)) {
|
|
|
809a25 |
+ # Old format: Received disconnect from 192.168.122.1: 11: disconnected by user
|
|
|
809a25 |
+ # New format: Received disconnect from 192.168.122.1 port 43680:11: disconnected by user
|
|
|
809a25 |
+ } elsif ( my ($Host,$Reason) = ($ThisLine =~ /^Received disconnect from ([^ ]*)(?: port \d+)?: ?(.*)$/)) {
|
|
|
809a25 |
$DisconnectReceived{$Reason}{$Host}++;
|
|
|
809a25 |
} elsif ( my ($Host) = ($ThisLine =~ /^ROOT LOGIN REFUSED FROM ([^ ]*)$/)) {
|
|
|
809a25 |
$RootLogin{$Host}++;
|