Fwd: sshd patch to fix BREAK-IN pattern and add pam_chroot tracking

---------- Forwarded message ----------
From: Alan Brenner <[email protected]>
Date: Tue, 23 Dec 2008 15:03:53 -0500
Subject: sshd patch to fix BREAK-IN pattern and add pam_chroot tracking
To: [email protected]

--- logwatch-7.3.6.orig/scripts/services/sshd   2007-04-15
16:59:02.000000000 -0400
+++ logwatch-7.3.6/scripts/services/sshd        2008-12-23
12:05:14.000000000 -0500
@@ -157,6 +157,7 @@
  my %RootLogin = ();
  my %PamReleaseFail = ();
  my %PamError = ();
+my %PamChroot = ();
  my %ShadowInfo = ();
  my %TTYModesFail = ();
  my %LoginLock = ();
@@ -303,7 +304,7 @@
        $BadLogins{$Host}{"$User/$Method"}++;
     } elsif ($ThisLine =~ s/^(log: )?Could not reverse map address
([^ ]*).*$/$2/) {
        $NoRevMap{$ThisLine}++;
-   } elsif ( my ($Address) = ($ThisLine =~ /^reverse mapping checking
getaddrinfo for ([^ ]*) failed - POSSIBLE BREAKIN ATTEMPT!/)) {
+   } elsif ( my ($Address) = ($ThisLine =~ /^reverse mapping checking
getaddrinfo for ([^ ]*) failed - POSSIBLE BREAK-?IN ATTEMPT!/)) {
        $NoRevMap{$Address}++;
     } elsif ( my ($IP,$Address) = ($ThisLine =~ /^Address ([^ ]*)
maps to ([^ ]*), but this does not map back to the address - POSSIBLE
BREAKIN ATTEMPT!/)) {
        $NoRevMap{"$Address($IP)"}++;
@@ -325,6 +326,8 @@
        $PamReleaseFail{$Error}++;
     } elsif ( my ($Error) = ( $ThisLine =~ m/^error: PAM: (.*)$/)) {
        $PamError{$Error}++;
+   } elsif ( my ($Reason) = ( $ThisLine =~ m/pam_chroot\(.+\):\s+([^:]
+)/)) {
+      $PamChroot{$Reason}++;
     } elsif ( my ($Error) = ( $ThisLine =~ m/^error: Could not get
shadow information for (.*)$/)) {
        $ShadowInfo{$Error}++;
     } elsif ( my ($Reason) = ($ThisLine =~ /^Setting tty modes
failed: (.*)$/)) {
@@ -625,6 +628,13 @@
     }
  }

+if (keys %PamChroot) {
+   print "\nPAM chroot:\n";
+   foreach my $Reason (sort {$a cmp $b} keys %PamChroot) {
+      print "   $Reason : $PamChroot{$Reason} Time(s)\n";
+   }
+}
+
  if (keys %TTYModesFail) {
     print "\nSetting tty modes failed:\n";
     foreach my $Reason (sort {$a cmp $b} keys %TTYModesFail) {


-- 
Sent from my mobile device


------------------------------------------------------
Kirk Bauer <[email protected]>
http://linux.kaybee.org | www.logwatch.org
Author, Automating UNIX & Linux Administration