Re: PATCH for sshd & man apge

Re-attached patch.

On Sun, Jan 1, 2017 at 10:50 PM Frank Crawford <[email protected]>
wrote:

> Related to this, what happened to the patch I sent in for SSHD in early
> September? If you want I can resubmit it.
>
> Regards
> Frank
>
> On Sun, 2017-01-01 at 14:14 -0500, Jason Pyeron wrote:
>
> no attachment!
>
>
>
> -----Original Message-----
> From: Adam Lehenbauer
> Sent: Sunday, January 01, 2017 13:02
>
> Hi did this patch make it through to anyone back in
> September? I guess the html in the initial message caused an
> issue, so in plain text here's what I had said:
>
> I've noticed that I get a lot of "Unmatched Entries" for
> repeated password failures from sshd, e.g.
>
>
>
> message repeated 2 times: [ Failed password for root from
> x.x.x.x port x ssh2] : 1 time(s)
>
>
> Attached patch pulls out the '2 times' and increments the
> failed attempts for the report, and removes these unmatched entries.
>
> This is a really big cleanup for me and hopefully will help
> others. I've also added some options to the man page that are
> listed in the synopsis and in --usage but spelled out in the
> body of the man page.
>
>
> On Sun, Sep 25, 2016 at 11:23 AM Adam Lehenbauer
> <[email protected]> wrote:
>
>
> 	Hello, I've noticed that I get a lot of "Unmatched
> Entries" for repeated password failures from sshd, e.g.
>
> message repeated 2 times: [ Failed password for root from
> x.x.x.x port x ssh2] : 1 time(s)	
>
> 	Attached patch pulls out the '2 times' and increments
> the failed attempts for the report, and removes these
> unmatched entries.
>
> 	This is a really big cleanup for me and hopefully will
> help others. I've also added some options to the man page
> that are listed in the synopsis and in --usage but spelled
> out in the body of the man page.
>
> 	-Adam
>
>
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
> _______________________________________________
> Logwatch-devel mailing listLogwatch-devel-5NWGOfrQmneRv+LV9MX5ugtCRVl27V+i0wdF1cv0I5s@public.gmane.org://lists.sourceforge.net/lists/listinfo/logwatch-devel
>
>

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most 
engaging tech sites, SlashDot.org! http://sdm.link/slashdot

_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel

diff --git a/logwatch.8 b/logwatch.8
index 47f1010..b356074 100644
--- a/logwatch.8
+++ b/logwatch.8
@@ -109,6 +109,22 @@ if HostLimit is set in the logwatch.conf configuration file (see
 then only logs from this hostname will be processed (where appropriate).
 .IP "\fB--html_wrap\fR num-characters"
 Number of characters that html output should be wrapped to. Default is 80.
+.IP "\fB--hostformat\fR split"
+Use
+.I split
+approach when formatting report for multiple hosts - none [default], split, splitmail.
+.IP "\fB--output\fR output-type"
+Report using
+.I output-type
+- stdout [default], mail, file.
+.IP "\fB--format\fR format"
+Format report using
+.I format
+- text [default], html.
+.IP "\fB--encode\fR encoding"
+Encode report using
+.I encoding
+- none [default], base64.
 .IP "\fB--numeric\fR"
 Inhibits additional name lookups, displaying IP addresses numerically.
 .IP "\fB--usage\fR"
diff --git a/scripts/services/sshd b/scripts/services/sshd
index a7edb41..b6c9ffd 100755
--- a/scripts/services/sshd
+++ b/scripts/services/sshd
@@ -371,6 +371,12 @@ while (defined(my $ThisLine = <STDIN>)) {
          print STDERR "DEBUG: Found -Failed login- line\n";
       }
       $BadLogins{$Host}{"$User/$Method"}++;
+   } elsif ( my ($Count,$Method,$User,$Host,undef) = ( $ThisLine =~ m/^message repeated (\d+) times: \[ Failed (\S+) for (\S+) from ([^ ]+) port (\d+)/ ) ) { #openssh
+      # depending on log mode, openssh may not report these in connection context.
+      if ( $Debug >= 5 ) {
+         print STDERR "DEBUG: Found -Failed login- line\n";
+      }
+      $BadLogins{$Host}{"$User/$Method"} += $Count;
    } elsif ($ThisLine =~ s/^(log: )?Could not reverse map address ([^ ]*).*$/$2/) {
       $NoRevMap{$ThisLine}++;
    } elsif ( my ($Address) = ($ThisLine =~ /^reverse mapping checking getaddrinfo for (\S+( \[\S+\])?) failed - POSSIBLE BREAK-IN ATTEMPT!/)) {