PATCH for sshd

--- /home/tsa/sshd	2017-01-01 23:45:57.340956919 +0100
+++ sshd	2017-01-02 17:27:29.708334850 +0100
@@ -188,7 +188,7 @@
 
 # No sense in running if 'sshd' doesn't even exist on this system...
 #unless (( -f "/usr/sbin/sshd" ) or ( -f "/usr/local/sbin/sshd") or ( -f "/usr/lib/ssh/sshd")) {
-#	exit (0);
+#       exit (0);
 #}
 
 my %Users = ();
@@ -201,6 +201,7 @@
 my %NoRevMap = ();
 my %RefusedConnections = ();
 my %RefusedAuthentication = ();
+my %NegotiationFailed = ();
 my %DisconnectReceived = ();
 my %RootLogin = ();
 my %PamReleaseFail = ();
@@ -223,7 +224,6 @@
 my %KrbAutFail = ();
 my %KrbAutErr = ();
 my %KrbErr = ();
-my @BadRSA = ();
 my @Scanned = ();
 my %OtherList = ();
 my %ChmodErr = ();
@@ -273,7 +273,7 @@
        ($ThisLine =~ m/^channel_lookup: -?\d+: bad id/) or
        ($ThisLine =~ m/^error: channel \d+: chan_read_failed for istate/) or
        # Result of setting PermitRootLogin to forced-commands-only
-       ($ThisLine =~ m/^Root login accepted for forced command.$/) or
+       ($ThisLine =~ m/^Root login accepted for forced command\.( \[preauth\])?$/) or
        # usually followed by a session opened for user
        ($ThisLine =~ m/^pam_krb5\[\d+\]: authentication succeeds for /) or
        ($ThisLine =~ m/^nss_ldap: reconnect/) or
@@ -283,11 +283,13 @@
        ($ThisLine =~ m/^\(pam_unix\) .*/) or
        ($ThisLine =~ m/^pam_unix\(.*:.*\)/) or
        ($ThisLine =~ m/^pam_unix_auth:/) or
+       ($ThisLine =~ m/^pam_sepermit\(.*:.*\)/) or
        ($ThisLine =~ /pam_krb5: authentication succeeds for `([^ ]*)'/) or
        ($ThisLine =~ /pam_succeed_if\(.*:.*\): error retrieving information about user [a-zA-Z]*/ ) or
        ($ThisLine =~ /pam_winbind\(sshd:account\): user .* granted access/) or
        ($ThisLine =~ /pam_winbind\(sshd:account\): user .* OK/) or
        ($ThisLine =~ /pam_systemd\(sshd:session\): Moving/) or
+       ($ThisLine =~ /pam_systemd\(sshd:session\): .*: Connection reset by peer/) or
        ($ThisLine =~ /PAM \d+ more authentication failures?;/) or
        ($ThisLine =~ /^PAM service\(sshd\) ignoring max retries;/) or
        ($ThisLine =~ /^Failed keyboard-interactive for <invalid username> from/ ) or
@@ -298,7 +300,8 @@
        ($ThisLine =~ /Found matching \w+ key:/ ) or
        ($ThisLine =~ /User child is on pid \d/ ) or
        ($ThisLine =~ /Nasty PTR record .* is set up for [\da-fA-F.:]+, ignoring/) or
-       ($ThisLine =~ /^SSH: Server;L[Tt]ype: /)
+       ($ThisLine =~ /^SSH: Server;L[Tt]ype: /) or
+       ($ThisLine =~ /Disconnected from [\da-fA-F.:]* port \d*/ )
    ) {
       # Ignore these
    } elsif ( my ($Method,$User,$Host,$Port,$Key) = ($ThisLine =~ /^Accepted (\S+) for ((?:invalid user )?\S+) from ([\d\.:a-f]+) port (\d+) ssh[12](?:: (\w+))?/) ) {
@@ -316,6 +319,10 @@
       $IllegalUsers{$Host}{$User}++;
    } elsif ( my ($User) = ( $ThisLine =~ /Disconnecting: Too many authentication failures for ([^ ]+)/)) {
       $TooManyFailures{$User}++;
+   } elsif ( my ($User) = ( $ThisLine =~ /error: maximum authentication attempts exceeded for (?:invalid user )?([^ ]+) from [^ ]+ port \d+ ssh2 \[preauth\]/)) {
+      $TooManyFailures{$User}++;
+   } elsif ( $ThisLine =~ /Disconnecting: Too many authentication failures \[preauth\]/ ) {
+      # Ignore these - should be covered by other messages
    } elsif ( $ThisLine =~ m/^(fatal: )?Did not receive ident(ification)? string from (.+)/ ) { # ssh/openssh
       my $name = LookupIP($3);
       $NoIdent{$name}++;
@@ -330,9 +337,12 @@
       ($ThisLine =~ m/^fatal: Write failed: Network is unreachable/ ) or
       ($ThisLine =~ m/^fatal: Write failed: Broken pipe/) or
       ($ThisLine =~ m/^fatal: Write failed: Connection reset by peer/) or
+      ($ThisLine =~ m/^Connection reset by/) or
       ($ThisLine =~ m/^channel \d+: open failed: (?:connect failed: Channel open failed\.|administratively prohibited: open failed)/) or
       ($ThisLine =~ m/^session_input_channel_req: no session \d+ req window-change/) or
-      ($ThisLine =~ m/^error: chan_shutdown_read failed for .+/)
+      ($ThisLine =~ m/^error: chan_shutdown_read failed for .+/) or
+      ($ThisLine =~ m/^Connection reset by.+/) or
+      ($ThisLine =~ m/^Disconnected from.+/) 
    ) {
       $NetworkErrors++;
    } elsif ( $ThisLine =~ m/^(log: )?Received (signal 15|SIG...); (terminating|restarting)\./) { #ssh/openssh
@@ -388,9 +398,20 @@
       $RefusedConnections{$1}++;
    } elsif ( my ($Reason) = ($ThisLine =~ /^Authentication refused: (.*)$/ ) ) {
       $RefusedAuthentication{$Reason}++;
-   } elsif ( my ($Host,$Reason) = ($ThisLine =~ /^Received disconnect from ([^ ]*): (.*)$/)) {
+   } elsif ( my ($Host,$Port,$Reason,$Offer) = ($ThisLine =~ /^(?:fatal: )?Unable to negotiate with ([^ ]+)( port \d+)?: (.*)\. Their offer: (.*) \[preauth\]$/) ) {
+      $NegotiationFailed{$Reason}{$Host}{$Offer}++;
+   } elsif ( my ($Reason,$Host,$Offer) = ($ThisLine =~ /^(Protocol major versions differ) for ([^ ]+): (.*)$/) ) {
+      $NegotiationFailed{$Reason}{$Host}{$Offer}++;
+   } elsif ( my ($Prio,$Host,$Port,$Code,$Reason) = ($ThisLine =~ /^(error: )?Received disconnect from ([^ ]*)( port \d+)?: ?(\d+): (.*) \[preauth\]$/)) {
+      if ($Code == 11) {
+      # Reason 11 (SSH_DISCONNECT_BY_APPLICATION) in [preauth] sounds suspicious
+         $DisconnectReceived{"$Reason [preauth]"}{$Host}++;
+      } else {
+         $DisconnectReceived{$Reason}{$Host}++;
+      }
+   } elsif ( my ($Prio,$Host,$Port,$Code,$Reason) = ($ThisLine =~ /^(error: )?Received disconnect from ([^ ]*)( port \d+)?: ?(\d+): (.*)$/)) {
       # Reason 11 (SSH_DISCONNECT_BY_APPLICATION) is expected, and logged at severity level INFO
-      if ($Reason != 11) {$DisconnectReceived{$Reason}{$Host}++;}
+      if ($Code != 11) {$DisconnectReceived{$Reason}{$Host}++;}
    } elsif ( my ($Host) = ($ThisLine =~ /^ROOT LOGIN REFUSED FROM ([^ ]*)$/)) {
       $RootLogin{$Host}++;
    } elsif ( my ($Error) = ($ThisLine =~ /^Cannot release PAM authentication\[\d\]: (.*)$/)) {
@@ -441,6 +462,9 @@
    } elsif ( my (undef,$User,$Host) = ($ThisLine =~ m/^(Illegal|Invalid) user (.*) from ([^ ]+)/ )) {
       $PotentialIllegalUsers{$Host}{$User}++;
    } elsif ( my (undef,$User) = ($ThisLine =~ /^input_userauth_request: (illegal|invalid) user (.*)$/ )) {
+      if ($User =~ m/(.*) \[preauth\]/) {
+        $User = $1;
+      }
       $PotentialIllegalUsers{"undef"}{$User}++;
    } elsif (my ($File,$Perm,$Why) = ($ThisLine =~ /error: chmod (.*) (.*) failed: (.*)/)) {
       $ChmodErr{"$File,$Perm,$Why"}++;
@@ -507,7 +531,7 @@
 if (keys %BindFailed) {
    print "\nFailed to bind:\n";
    foreach my $ThisOne (sort {$a cmp $b} keys %BindFailed) {
-	   print "   $ThisOne : $BindFailed{$ThisOne} Time(s)\n";
+           print "   $ThisOne : $BindFailed{$ThisOne} Time(s)\n";
    }
 }
 
@@ -532,10 +556,35 @@
    }
 }
 
-if ($#BadRSA >= 0) {
-   print "\nReceived a bad response to RSA challenge from:\n";
-   foreach my $ThisOne (@BadRSA) {
-      print "   $ThisOne\n";
+if (keys %NegotiationFailed) {
+   print "\nNegotiation failed:\n";
+   foreach my $Reason (sort {$a cmp $b} keys %NegotiationFailed) {
+      my $Total = 0;
+      print "   $Reason";
+      foreach my $Host (sort {$a cmp $b} keys %{$NegotiationFailed{$Reason}}) {
+        my $HostTotal = 0;
+        foreach my $Offer (sort {$a cmp $b} keys %{$NegotiationFailed{$Reason}{$Host}}) {
+           $HostTotal += $NegotiationFailed{$Reason}{$Host}{$Offer};
+        }
+        $Total += $HostTotal;
+        if ( $Detail > 0 ) {
+           my $plural = ($HostTotal > 1) ? "s" : "";
+           print "\n      $Host: $HostTotal time$plural";
+        }
+        if ( $Detail > 5 ) {
+           foreach my $Offer (sort {$a cmp $b} keys %{$NegotiationFailed{$Reason}{$Host}}) {
+                 my $tot = $NegotiationFailed{$Reason}{$Host}{$Offer};
+                 my $plural = ($tot > 1) ? "s" : "";
+                 print "\n        $Offer: $tot time$plural";
+           }
+        }
+      }
+      if( $Detail > 0 ) {
+         print "\n";
+      } else {
+         my $plural = ($Total > 1) ? "s" : "";
+         print ": $Total time$plural\n";
+      }
    }
 }
 
@@ -686,7 +735,7 @@
 }
 
 if (keys %RefusedAuthentication) {
-   print "\n\nAuthentication refused:\n";
+   print "\nAuthentication refused:\n";
    foreach my $Reason (sort {$a cmp $b} keys %RefusedAuthentication) {
       print "   $Reason : $RefusedAuthentication{$Reason} Time(s)\n";
    }
@@ -716,7 +765,7 @@
 
 
 if (keys %DisconnectReceived) {
-   print "\n\nReceived disconnect:\n";
+   print "\nReceived disconnect:\n";
    foreach my $Reason (sort {$a cmp $b} keys %DisconnectReceived) {
       my $Total = 0;
       print "   $Reason";