sshd logwatch enhancement patch
JT Moree <[email protected]>
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello again, I have created another enhancement to a logwatch script. (i guess you probably won't remember me since it was months ago that I emailed you with the last one.) This patch to the ssh service adds a threshold variable that changes the output behaviour for the refused connections section. 1) If $RefusedConnectionsThreshold == 0: nothing is different 2) If $Detail > 5: nothing is different 3) otherwise during the output for refused connections, a connection is only printed if it has been refused more than (or equal to) the threshold value I left it at 0 so that the default behaviour does not change. But I can't figure out how to change the variable from anywhere else. I tried overriding in various configuration files in various locations. I attached the sshd.conf above that I'm using in /etc/logwatch/conf/services/sshd.conf I don't see the script reading these variables from the config files so I don't know how it would get the data. There is another variable in the default config file that I wonder might have the same problem. Anyway the patch works fine whether or not the config file has the varible and I will probably just set it to what I want in the script for now. Thank you, - -- JT Moree -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFGEUXxFI6sVJUR1B8RAlxhAKCFToJwLWBvZWnVVIvl4LWhkoBsTQCePcuj 7523oalxNrnNgIyVjqqWXvA= =2LBp -----END PGP SIGNATURE----- _______________________________________________ Logwatch-Devel mailing list [email protected] http://www2.list.logwatch.org:81/mailman/listinfo/logwatch-devel
sshd.patch
(text/plain, 1.2 KB)
--- sshd.165 2007-04-02 09:56:04.000000000 -0700
+++ sshd 2007-04-02 10:22:51.000000000 -0700
@@ -2,6 +2,9 @@
# $Id: sshd,v 1.65 2007/01/29 20:09:17 bjorn Exp $
##########################################################################
# $Log: sshd,v $
+# 2007/4/2 JT Moree
+# Added threshold variable for refused connections count output
+#
# Revision 1.65 2007/01/29 20:09:17 bjorn
# Improved filtering, by Ivana Varekova.
#
@@ -147,6 +150,7 @@
my %BadLogins = ();
my %NoRevMap = ();
my %RefusedConnections = ();
+my $RefusedConnectionsThreshold = 0;
my %RefusedAuthentication = ();
my %DisconnectReceived = ();
my %RootLogin = ();
@@ -587,9 +591,15 @@
}
if (keys %RefusedConnections) {
- print "\nRefused incoming connections:\n";
+ my $output;
foreach my $badguy (sort {$a cmp $b} keys %RefusedConnections ) {
- print " $badguy: " . $RefusedConnections{$badguy} . " Time(s)\n";
+ if ($RefusedConnectionsThreshold == 0 || $Detail > 5 || $RefusedConnections{$badguy} >= $RefusedConnectionsThreshold) {
+ $output .= " $badguy: " . $RefusedConnections{$badguy} . " Time(s)\n";
+ }
+ }
+ if ($output ne '') {
+ print "\nRefused incoming connections:\n";
+ print $output;
}
}
sshd.conf.patch
(text/plain, 986 B)
--- sshd.conf.orig 2007-04-02 11:00:47.000000000 -0700 +++ sshd.conf 2007-04-02 11:00:23.000000000 -0700 @@ -27,6 +27,17 @@ # addresses (IETF RFC 1918 and RFC 3330). #$sshd_ignore_host="^10\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^192\.168\.|^127\." +# The refused connections report lists every ip that is refused even if +# it was only refused 1 or 2 times. In a case like that I don't care +# to see the information. It is just noise. I want to know when a +# a connection has been refused 10, 20, 30 times because that is an +# indication of an attack or a problem. +# Set this variable to a positive integer to trim out the lower count +# refused connections from the report. i.e. 10 would not show any hosts +# with less than 10 refusals. +# This has no effect if the $Detail variable is greater than 5. +$RefusedConnectionsThreshold = 10 + ######################################################## # This was written and is maintained by: # Kirk Bauer <[email protected]>
sshd.conf
(text/plain, 1.8 KB)
########################################################################### # $Id: sshd.conf,v 1.17 2005/12/07 04:30:21 bjorn Exp $ ########################################################################### # You can put comments anywhere you want to. They are effective for the # rest of the line. # this is in the format of <name> = <value>. Whitespace at the beginning # and end of the lines is removed. Whitespace before and after the = sign # is removed. Everything is case *insensitive*. # Yes = True = On = 1 # No = False = Off = 0 Title = "SSHD" # Which logfile group... LogFile = secure LogFile = messages # Only give lines pertaining to the sshd service... *OnlyService = sshd *RemoveHeaders # Variable $sshd_ignore_host is used to filter out hosts that login # successfully. This commented-out example filters out reserved local # addresses (IETF RFC 1918 and RFC 3330). #$sshd_ignore_host="^10\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^192\.168\.|^127\." # The refused connections report lists every ip that is refused even if # it was only refused 1 or 2 times. In a case like that I don't care # to see the information. It is just noise. I want to know when a # a connection has been refused 10, 20, 30 times because that is an # indication of an attack or a problem. # Set this variable to a positive integer to trim out the lower count # refused connections from the report. i.e. 10 would not show any hosts # with less than 10 refusals. # This has no effect if the $Detail variable is greater than 5. $RefusedConnectionsThreshold = 10 ######################################################## # This was written and is maintained by: # Kirk Bauer <[email protected]> # # Please send all comments, suggestions, bug reports, # etc, to [email protected]. ######################################################## # vi: shiftwidth=3 tabstop=3 et