Fwd: updates for services/sshd

Here is another one.  Again maybe the first should be (assuming the message
has changed at some point):

} elsif ( my ($Address) = ($ThisLine =~ /^reverse mapping checking
getaddrinfo for ([^ ]*) failed - POSSIBLE BREAK-?IN ATTEMPT!/)) {



--- sshd	2006-07-25 01:14:32.000000000 +0200
+++ sshd	2006-07-25 02:26:46.000000000 +0200
@@ -125,7 +125,9 @@
 my %PostPonedAuth = ();
 my %LockedAccount = ();
 my %AllowUsers = ();
+my %AllowGroups = ();
 my %NoShellUsers = ();
+my %ShellNotExecutableUsers = ();
 my %DeprecatedOption = ();
 my %MisMatch = ();
 my @BadRSA = ();
@@ -253,7 +255,7 @@
       $BadLogins{$Host}{"$User/$Method"}++;
    } elsif ($ThisLine =~ s/^(log: )?Could not reverse map address ([^
]*).*$/$2/) {
       $NoRevMap{$ThisLine}++;
-   } elsif ( my ($Address) = ($ThisLine =~ /^reverse mapping checking
getaddrinfo for ([^ ]*) failed - POSSIBLE BREAKIN ATTEMPT!/)) {
+   } elsif ( my ($Address) = ($ThisLine =~ /^reverse mapping checking
getaddrinfo for ([^ ]*) failed - POSSIBLE BREAK-IN ATTEMPT!/)) {
       $NoRevMap{$Address}++;
    } elsif ( my ($IP,$Address) = ($ThisLine =~ /^Address ([^ ]*) maps
to ([^ ]*), but this does not map back to the address - POSSIBLE
BREAKIN ATTEMPT!/)) {
       $NoRevMap{"$Address($IP)"}++;
@@ -288,8 +290,12 @@
       $LockedAccount{$User}++;
    } elsif ( my ($User) = ($ThisLine =~ /^User ([^ ]*) not allowed
because not listed in AllowUsers/)) {
       $AllowUsers{$User}++;
+   } elsif ( my ($User) = ($ThisLine =~ /^User ([^ ]*) from ([^ ]*)
not allowed because none of user's groups are listed in AllowGroups/))
{
+      $AllowGroups{$User}++;
    } elsif ( ($User) = ($ThisLine =~ /^User ([^ ]*) not allowed
because shell (\S+) does not exist/)) {
       $NoShellUsers{$User}++;
+   } elsif ( ($User) = ($ThisLine =~ /^User ([^ ]*) not allowed
because shell (\S+) is not executable/)) {
+      $ShellNotExecutableUsers{$User}++;
    } elsif ( my ($IP) = ($ThisLine =~ /^scanned from ([^ ]*)/) ) {
       push @Scanned, $IP;
    } elsif ( my ($Line,$Option) = ($ThisLine =~ /^rexec line (\d+):
Deprecated option (.*)$/)) {
@@ -427,6 +433,13 @@
    }
 }

+if (keys %AllowGroups) {
+   print "\nLogin attempted when not in AllowGroups list:\n";
+   foreach my $User (sort {$a cmp $b} keys %AllowGroups) {
+      print "   $User : $AllowGroups{$User} Time(s)\n";
+   }
+}
+
 if (keys %NoShellUsers) {
    print "\nLogin attempted when shell does not exist:\n";
    foreach my $User (sort {$a cmp $b} keys %NoShellUsers) {
@@ -434,6 +447,13 @@
    }
 }

+if (keys %ShellNotExecutableUsers) {
+   print "\nLogin attempted when shell is not executable:\n";
+   foreach my $User (sort {$a cmp $b} keys %ShellNotExecutableUsers) {
+      print "   $User : $ShellNotExecutableUsers{$User} Time(s)\n";
+   }
+}
+
 if ((keys %LoginLock) and ($Detail >= 5)) {
    print "\nUser login attempt when nologin was set:\n";
    foreach my $User (sort {$a cmp $b} keys %LoginLock) {



---------- Forwarded message ----------
From: Daniel Webert <[email protected]>
Date: May 23, 2007 7:25 PM
Subject: updates for services/sshd
To: [email protected]

this patch is from Jesus de Santos Garcia ([email protected]) found
in http://bugs.gentoo.org/show_bug.cgi?id=141649



-- 
Kirk Bauer <[email protected]>
http://linux.kaybee.org | www.autorpm.org | www.logwatch.org

_______________________________________________
Logwatch-Devel mailing list
[email protected]
http://www2.list.logwatch.org:81/mailman/listinfo/logwatch-devel

--- sshd	2006-07-25 01:14:32.000000000 +0200
+++ sshd	2006-07-25 02:26:46.000000000 +0200
@@ -125,7 +125,9 @@ 
 my %PostPonedAuth = ();
 my %LockedAccount = ();
 my %AllowUsers = ();
+my %AllowGroups = ();
 my %NoShellUsers = ();
+my %ShellNotExecutableUsers = ();
 my %DeprecatedOption = ();
 my %MisMatch = ();
 my @BadRSA = ();
@@ -253,7 +255,7 @@ 
       $BadLogins{$Host}{"$User/$Method"}++;
    } elsif ($ThisLine =~ s/^(log: )?Could not reverse map address ([^ ]*).*$/$2/) {
       $NoRevMap{$ThisLine}++;
-   } elsif ( my ($Address) = ($ThisLine =~ /^reverse mapping checking getaddrinfo for ([^ ]*) failed - POSSIBLE BREAKIN ATTEMPT!/)) {
+   } elsif ( my ($Address) = ($ThisLine =~ /^reverse mapping checking getaddrinfo for ([^ ]*) failed - POSSIBLE BREAK-IN ATTEMPT!/)) {
       $NoRevMap{$Address}++;
    } elsif ( my ($IP,$Address) = ($ThisLine =~ /^Address ([^ ]*) maps to ([^ ]*), but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT!/)) {
       $NoRevMap{"$Address($IP)"}++;
@@ -288,8 +290,12 @@ 
       $LockedAccount{$User}++;
    } elsif ( my ($User) = ($ThisLine =~ /^User ([^ ]*) not allowed because not listed in AllowUsers/)) {
       $AllowUsers{$User}++;
+   } elsif ( my ($User) = ($ThisLine =~ /^User ([^ ]*) from ([^ ]*) not allowed because none of user's groups are listed in AllowGroups/)) {
+      $AllowGroups{$User}++;    
    } elsif ( ($User) = ($ThisLine =~ /^User ([^ ]*) not allowed because shell (\S+) does not exist/)) {
       $NoShellUsers{$User}++;
+   } elsif ( ($User) = ($ThisLine =~ /^User ([^ ]*) not allowed because shell (\S+) is not executable/)) {
+      $ShellNotExecutableUsers{$User}++;
    } elsif ( my ($IP) = ($ThisLine =~ /^scanned from ([^ ]*)/) ) {
       push @Scanned, $IP;
    } elsif ( my ($Line,$Option) = ($ThisLine =~ /^rexec line (\d+): Deprecated option (.*)$/)) {
@@ -427,6 +433,13 @@ 
    }
 }
 
+if (keys %AllowGroups) {
+   print "\nLogin attempted when not in AllowGroups list:\n";
+   foreach my $User (sort {$a cmp $b} keys %AllowGroups) {
+      print "   $User : $AllowGroups{$User} Time(s)\n";
+   }
+}
+
 if (keys %NoShellUsers) {
    print "\nLogin attempted when shell does not exist:\n";
    foreach my $User (sort {$a cmp $b} keys %NoShellUsers) {
@@ -434,6 +447,13 @@ 
    }
 }
 
+if (keys %ShellNotExecutableUsers) {
+   print "\nLogin attempted when shell is not executable:\n";
+   foreach my $User (sort {$a cmp $b} keys %ShellNotExecutableUsers) {
+      print "   $User : $ShellNotExecutableUsers{$User} Time(s)\n";
+   }
+}
+
 if ((keys %LoginLock) and ($Detail >= 5)) {
    print "\nUser login attempt when nologin was set:\n";
    foreach my $User (sort {$a cmp $b} keys %LoginLock) {