Patch for illegal user threshold in sshd service file

This is a multi-part message in MIME format.
--------------EF13A2149B0F2DCABAC8D5DA
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit

Hi,

for the sshd service there is already an option to supress refused
connections based on $refused_connections_threshold. As I also found
that there is a large number of Illegal User entries (lot's of unique
IPs with only one try) I added a new threshold via a local override. I
assume I can't be the only one with this problem I would liek to submit
my change as a patch so it is availale with the next release.

The default sshd.conf needs to be adjusted too. I can submit a patch
based on the existing text for refused_connections_threshold if required.

-- 

MfG / Regards
Christian Beer


--------------EF13A2149B0F2DCABAC8D5DA
Content-Type: text/x-patch;
 name="logwatch-illegalusers.diff"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename="logwatch-illegalusers.diff"

--- /usr/share/logwatch/scripts/services/sshd   2018-12-30 10:17:30.000000000 +0100
+++ /etc/logwatch/scripts/services/sshd 2019-04-19 08:46:34.340755244 +0200
@@ -185,6 +185,7 @@
 my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;
 my $IgnoreHost = $ENV{'sshd_ignore_host'} || "";
 my $RefusedConnectionsThreshold = $ENV{'refused_connections_threshold'} || 0;
+my $IllegalUsersThreshold = $ENV{'illegal_users_threshold'} || 0;
 my $DebugCounter = 0;
 
 # No sense in running if 'sshd' doesn't even exist on this system...
@@ -685,7 +686,9 @@
       foreach my $user (keys %{$IllegalUsers{$ip}}) {
          $totcount += $IllegalUsers{$ip}{$user};
       }
-      print "   $name: " . timesplural($totcount);
+      if ($IllegalUsersThreshold == 0 || $Detail >= 5 || $totcount >= $IllegalUsersThreshold) {
+         print "   $name: " . timesplural($totcount);
+      }
       if ($Detail >= 5) {
          my $sort = CountOrder(%{$IllegalUsers{$ip}});
          foreach my $user (sort $sort keys %{$IllegalUsers{$ip}}) { 

--------------EF13A2149B0F2DCABAC8D5DA
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--------------EF13A2149B0F2DCABAC8D5DA
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel

--------------EF13A2149B0F2DCABAC8D5DA--