PATCH for sshd & man apge

Adam Lehenbauer <[email protected]> Sun, 25 Sep 2016 15:23:19 +0000

Newsgroups	gmane.comp.log.logwatch.devel
Message-ID	<CAMkUn-=Con-50aEP2XN8D3siUpNsC7Lg4i5xV43==8vANicWeA@mail.gmail.com>

Hello, I've noticed that I get a lot of "Unmatched Entries" for repeated
password failures from sshd, e.g.

message repeated 2 times: [ Failed password for root from x.x.x.x port x
ssh2] : 1 time(s)

Attached patch pulls out the '2 times' and increments the failed attempts
for the report, and removes these unmatched entries.

This is a really big cleanup for me and hopefully will help others. I've
also added some options to the man page that are listed in the synopsis and
in --usage but spelled out in the body of the man page.

-Adam

------------------------------------------------------------------------------

_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel

sshd-man.patch (application/octet-stream, 1.8 KB)

diff --git a/logwatch.8 b/logwatch.8
index 47f1010..b356074 100644
--- a/logwatch.8
+++ b/logwatch.8
@@ -109,6 +109,22 @@ if HostLimit is set in the logwatch.conf configuration file (see
 then only logs from this hostname will be processed (where appropriate).
 .IP "\fB--html_wrap\fR num-characters"
 Number of characters that html output should be wrapped to. Default is 80.
+.IP "\fB--hostformat\fR split"
+Use
+.I split
+approach when formatting report for multiple hosts - none [default], split, splitmail.
+.IP "\fB--output\fR output-type"
+Report using
+.I output-type
+- stdout [default], mail, file.
+.IP "\fB--format\fR format"
+Format report using
+.I format
+- text [default], html.
+.IP "\fB--encode\fR encoding"
+Encode report using
+.I encoding
+- none [default], base64.
 .IP "\fB--numeric\fR"
 Inhibits additional name lookups, displaying IP addresses numerically.
 .IP "\fB--usage\fR"
diff --git a/scripts/services/sshd b/scripts/services/sshd
index a7edb41..b6c9ffd 100755
--- a/scripts/services/sshd
+++ b/scripts/services/sshd
@@ -371,6 +371,12 @@ while (defined(my $ThisLine = <STDIN>)) {
          print STDERR "DEBUG: Found -Failed login- line\n";
       }
       $BadLogins{$Host}{"$User/$Method"}++;
+   } elsif ( my ($Count,$Method,$User,$Host,undef) = ( $ThisLine =~ m/^message repeated (\d+) times: \[ Failed (\S+) for (\S+) from ([^ ]+) port (\d+)/ ) ) { #openssh
+      # depending on log mode, openssh may not report these in connection context.
+      if ( $Debug >= 5 ) {
+         print STDERR "DEBUG: Found -Failed login- line\n";
+      }
+      $BadLogins{$Host}{"$User/$Method"} += $Count;
    } elsif ($ThisLine =~ s/^(log: )?Could not reverse map address ([^ ]*).*$/$2/) {
       $NoRevMap{$ThisLine}++;
    } elsif ( my ($Address) = ($ThisLine =~ /^reverse mapping checking getaddrinfo for (\S+( \[\S+\])?) failed - POSSIBLE BREAK-IN ATTEMPT!/)) {