Request: Add dropbear support
Jakob Albert <[email protected]> Tue, 18 Oct 2022 18:26:29 +0200
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
Hello everyone, as far as I can see it, there is currently no support for [dropbear], is there? I use dropbear as an SSH Server inside an Alpine Container. The following three lines are generated in `/var/log/messages` for each connection: ``` authpriv.info dropbear[1571]: Child connection from 000.000.000.000:12345 authpriv.notice dropbear[1571]: Pubkey auth succeeded for 'username' with ssh-ed25519 key SHA256:sshKeyHash from 000.000.000.000:12345 authpriv.info dropbear[1571]: Exit (username) from <000.000.000.000:12345>: Disconnect received ``` where: - `000.000.000.000` is an IPv4 address - `12345` is a port - `username` is the user - `sshKeyHash` is the hash of the connecting SSH key Could you please add support for [dropbear]? I see two possibilities for this: 1. Adding a completely new service 2. Expanding the current SSHD service I already tried the second option by: - Replacing the `OnlyService` in `default.conf/services/sshd.conf` with dropbear - Adding dropbear to `ignore_services` in `default.conf/services/secure.conf` - Adding an ignore rule for the disconnect in `scripts/services/sshd`: `($ThisLine =~ /Exit \(.*\) from <\d+\.\d+\.\d+\.\d+:\d+>: Disconnect received/)` But I do not know how to correctly add a successful login to the output (and have currently disabled the normal sshd service in `sshd.conf`). The rest does work, but to be honest, I think that it makes much more sense to use a completely new service for dropbear - but again, I do not know how to correctly write a new service. If you need further information, I will be happy to provide it. Also, there will probably be a lot more log messages that are possible, but those three are the only ones I have encountered so far. Thank you very much and best regards Jakob [dropbear]: https://matt.ucc.asn.au/dropbear/