Re: Fwd: exclusion of ssh failures

> 
> Every computer on every network that I work on gets
> a load of (automatic) attempted ssh logins every day.
> The weekly logwatch email is typically approaching
> 1MB in size, almost entirely from ssh and pam login
> failures all being listed.  This huge amount of data is
> not at all important compared to knowing what logins
> did actually succeed, and other information such as
> kernel messages.
> 
> In my installation (logwatch-7.3.2 according to gentoo)
> there seems no way to avoid this, other than the crude
> changes I've made to the ssh2 and pam_unix scripts.
> Even setting the Detail to 1 doesn't remove this.
> It strikes me that such a lot of failure details ought
> only to be seen at a much higher level, e.g. 8, since
> they could be summarised as 'N failed login attempts'.
> Perhaps I've missed some other config setting?
> 
> Suggestions:  extra setting in a config file for pam_unix
> and ssh[2] to exclude or summarise failures;  or, just
> put them to a higher detail level.
> 

My first thought is upgrade to 7.3.6 [or even better grab the CVS 
version it is stable and close to be done for 8.0]

For me under Centos 4 I get a short PAM_UNIX section and a longer SSHD 
section like so....


PAM_UNIX

  sshd:
     Authentication Failures:
        unknown (66.98.156.49): 19 Time(s)
        root (66.98.156.49): 1 Time(s)
     Invalid Users:
        Unknown Account: 19 Time(s)
     Sessions Opened:
        mgt: 2 Time(s)


SSHD

  Couldn't resolve these IPs:
     ev1s-66-98-156-49.ev1servers.net: 20 Time(s)

  Didn't receive an ident from these IPs:
     66.98.156.49 (ev1s-66-98-156-49.ev1servers.net): 1 Time(s)
     85.114.132.161 (server.legiohost.com): 1 Time(s)

  Failed logins from:
     66.98.156.49 (ev1s-66-98-156-49.ev1servers.net): 1 time
        root/password: 1 time

  Illegal users from:
     undef: 19 times
        t1na: 2 times
        addicted: 1 time
        b1ablo: 1 time
        baggio: 1 time
        blue: 1 time
        diablo: 1 time
        globe: 1 time
        kim: 1 time
        logic: 1 time
        oscar: 1 time
        paradise: 1 time
        paradisse: 1 time
        pink: 1 time
        postgres: 1 time
        red: 1 time
        roberto: 1 time
        simbol: 1 time
        space: 1 time
     66.98.156.49 (ev1s-66-98-156-49.ev1servers.net): 19 times
        t1na: 2 times
        addicted: 1 time
        b1ablo: 1 time
        baggio: 1 time
        blue: 1 time
        diablo: 1 time
        globe: 1 time
        kim: 1 time
        logic: 1 time
        oscar: 1 time
        paradise: 1 time
        paradisse: 1 time
        pink: 1 time
        postgres: 1 time
        red: 1 time
        roberto: 1 time
        simbol: 1 time
        space: 1 time

  Received disconnect:
     11: Bye Bye
        66.98.156.49 : 19 Time(s)


Describe how you would like it tightened down and I'll see what I can do.


-Mike