Re: Fwd: sudo patch to count failed authentications

> ---------- Forwarded message ----------
> From: Alan Brenner <[email protected]>
> Date: Tue, 23 Dec 2008 15:05:12 -0500
> Subject: sudo patch to count failed authentications
> To: [email protected]
> 
.
.
> 
> +   } elsif ( ($dir, $cmd, $args, $tty, $euser, $user) = $ThisLine =~
> m/^pam_unix.sudo:auth.: authentication failure; logname=(\S+)\s+uid=(\d
> +)\s+euid=(\d+)\s+tty=(\S+)\s+ruser=(.*?)\s+user=(\S+)/) {
> +      $user ||= $euser;
> +      $authFail{"$user ($dir): $cmd ($args) on $tty"}++;


This actually should be handled correctly in the pam_unix service. In 
CVS the sudo service now correctly ignores all pam_unix entries.

-Mike