Hi, on Tue, Oct 11, 2005 at 02:34:31 +0200, Elmar Hoffmann wrote:
> While violations.ignore.d/logcheck-ssh does filter out the warnings > about failed reverse DNS lookup from the TCP wrappers, it does not for > ssh's own messages (which are quite overly dramatic, too). > The attached patch fixes this. Added another variant of these messages. Note that I also used the pattern [._[:alnum:]-]+ for the IP address, instead of a more restrictive one, just like the existing rules in this file for the TCP wrappers entries do - you might want to tighten them both. elmar -- .'"`. /"\ | :' : Elmar Hoffmann <[EMAIL PROTECTED]> ASCII Ribbon Campaign \ / `. `' GPG key available via pgp.net against HTML email X `- & vCards / \
--- /etc/logcheck/violations.ignore.d/logcheck-ssh.dpkg-dist 2005-10-11
01:37:46.356925928 +0200
+++ /etc/logcheck/violations.ignore.d/logcheck-ssh 2005-10-14
16:33:27.129387970 +0200
@@ -1,2 +1,4 @@
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: warning: /etc/hosts.deny,
line [0-9]+: can't verify hostname: getaddrinfo\([._[:alnum:]-]+, AF_INET\)
failed$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: warning: /etc/hosts.deny,
line [0-9]+: host name/name mismatch: [._[:alnum:]-]+ != [._[:alnum:]-]+$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: reverse mapping checking
getaddrinfo for [._[:alnum:]-]+ failed - POSSIBLE BREAKIN ATTEMPT!$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Address [._[:alnum:]-]+
maps to [._[:alnum:]-]+, but this does not map back to the address - POSSIBLE
BREAKIN ATTEMPT!$
signature.asc
Description: Digital signature
