On 10-11-2015 11:55, Dag-Erling Smørgrav wrote:
> Willem Jan Withagen <w...@digiware.nl> writes:
>> I know I've installed the ports once to see if, and how I would be
>> able to add more IP-address infor to some of the warnings and
>> errors. And then to get thos errors recognised by tools like sshguard
>> and fail2ban.
>
> Do you mean logging IP addresses instead of hostnames? Just turn off
> UseDNS. It is off by default since 6.8.
No not really....
Digging in my logfiles .... , and its things like:
sshd[84942]: Disconnecting: Too many authentication failures [preauth]
So errors/warnings without IP-nr.
And I think I fixed it on one server to also write:
error: maximum authentication attempts exceeded for root from
173.254.203.88 port 1042 ssh2 [preauth]
Which when I found out that upstreaming patches from base will be hard,
because the whole logging in the ports version is totally different.
> If you mean adding IP addresses or hostnames to messages that don't
> already have them, try suggesting it on the openssh-portable mailing
> list (openssh-unix-...@mindrot.org).
Are they still willing to accept changes to the old version that is
currently in base?
--WjW
_______________________________________________
freebsd-security@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscr...@freebsd.org"
