Fwd: Fwd: Fwd: exclusion of ssh failures

(sorry guys, just relaying messages here :)


---------- Forwarded message ----------
From: Nathaniel Taylor <[email protected]>
Date: Sun, May 25, 2008 at 5:33 AM
Subject: Re: Fwd: [Logwatch-Devel] Fwd: exclusion of ssh failures
To: Kirk Bauer <[email protected]>



Thanks for the reply.

I still think that reporting every failed ssh login, both in an ssh
section and a pam_unix section, is something that should
happen only at a higher log level than "low".
At the low level, the information could at least be
summarised in the style of iptables data, either stating
"N failed ssh logins" or "N from host H" for hosts that made
many attempts.   Too much data just distracts from the useful
information.

'Working the problem' in your implied way (filtering
network connections) is admittedly something that
I ought to do on most of the general purpose machines,
without inconveniencing people much.
But, *some* computer on our net would still need to be
open to all our people who travel; we can't practically block
the majority of internet addresses then try to predict those
of hotels, homes etc.  There must be quite a few logwatch-
using computers in the world that have the same need(?)

Regards,
Nathaniel

On Sunday 25 May 2008 14:10:00 you wrote:
> Suggestion from the list...
>
>
> My advise: Work the problem and not the logs that are indicating the
> problem. One propably does not need the whole world to use SSH to access
> these machines.
>
> Hugo.
>




-- 
Kirk Bauer <[email protected]>
http://linux.kaybee.org | www.logwatch.org
Author, Automating UNIX & Linux Administration