Sshd - incorrect behavior (patch included)

Hello all,

currently, the sshd service script is not behaving correctly. Consider the
following input:
  Jan 18 18:22:04 raptor sshd[8045]: Invalid user cisco from 10.132.4.251
  Jan 19 00:22:04 raptor sshd[8046]: input_userauth_request: invalid user cisco

The script as it is now reports:
  Illegal users from:
      undef: 1 times
      10.132.4.251: 1 times
as it reports the same user but two different messages.

Attached is a patch resolving this problem.

-- 
Jan Synacek
Software Engineer, BaseOS team Brno, Red Hat

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel

--- sshd.orig	2012-04-27 10:13:45.000000000 +0200
+++ sshd	2012-04-27 13:57:36.880932891 +0200
@@ -450,8 +450,19 @@ while (defined(my $ThisLine = <STDIN>))
 
 foreach my $Host (keys %PotentialIllegalUsers) {
    foreach my $User (keys %{$PotentialIllegalUsers{$Host}}) {
-      while ($IllegalUsers{$Host}{$User} < $PotentialIllegalUsers{$Host}{$User}) {
-	 $IllegalUsers{$Host}{$User}++;
+      my @user_hosts = grep { $PotentialIllegalUsers{$_}{$User} } keys %PotentialIllegalUsers;
+
+      if ($Host eq "undef") {
+         if ((scalar @user_hosts) == 1 && $user_hosts[0] == "undef") {
+            # Report illegal user from "undef" only if there are no other hosts
+            # for the given user
+            $IllegalUsers{"undef"}{$User}++;
+         }
+      }
+      else {
+         while ($IllegalUsers{$Host}{$User} < $PotentialIllegalUsers{$Host}{$User}) {
+            $IllegalUsers{$Host}{$User}++;
+         }
       }
    }
 }