Request: Add dropbear support

Jakob Albert <[email protected]> Tue, 18 Oct 2022 18:26:29 +0200
Newsgroups gmane.comp.log.logwatch.devel
Message-ID <[email protected]>
Hello everyone,

as far as I can see it, there is currently no support for [dropbear], is there?

I use dropbear as an SSH Server inside an Alpine Container.
The following three lines are generated in `/var/log/messages` for each connection:
```
authpriv.info dropbear[1571]: Child connection from 000.000.000.000:12345
authpriv.notice dropbear[1571]: Pubkey auth succeeded for 'username' with ssh-ed25519 key SHA256:sshKeyHash from 000.000.000.000:12345
authpriv.info dropbear[1571]: Exit (username) from <000.000.000.000:12345>: Disconnect received
```

where:
- `000.000.000.000` is an IPv4 address
- `12345` is a port
- `username` is the user
- `sshKeyHash` is the hash of the connecting SSH key

Could you please add support for [dropbear]?
I see two possibilities for this:

1. Adding a completely new service
2. Expanding the current SSHD service

I already tried the second option by:
- Replacing the `OnlyService` in `default.conf/services/sshd.conf` with dropbear
- Adding dropbear to `ignore_services` in `default.conf/services/secure.conf`
- Adding an ignore rule for the disconnect in `scripts/services/sshd`:
`($ThisLine =~ /Exit \(.*\) from <\d+\.\d+\.\d+\.\d+:\d+>: Disconnect received/)`

But I do not know how to correctly add a successful login to the output
(and have currently disabled the normal sshd service in `sshd.conf`).
The rest does work, but to be honest, I think that it makes much more sense
to use a completely new service for dropbear - but again,
I do not know how to correctly write a new service.

If you need further information, I will be happy to provide it.
Also, there will probably be a lot more log messages that are possible,
but those three are the only ones I have encountered so far.


Thank you very much and best regards

Jakob


[dropbear]: https://matt.ucc.asn.au/dropbear/