fredrik/logcheck
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

En regel för SSH

Browse Source
This commit is contained in:
Fredrik Wahlberg
2016-08-17 09:21:17 +02:00
parent 88f13662f9
commit 58701ab93e
2 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
logcheck_ignore
View File

@@ -405,6 +405,10 @@
#May 5 10:08:49 nada sshd[4523]: fatal: no hostkey alg [preauth] #May 5 10:08:49 nada sshd[4523]: fatal: no hostkey alg [preauth]
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: no hostkey alg \[preauth\] ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: fatal: no hostkey alg \[preauth\]
#Aug 16 19:28:06 nada sshd[12135]: Postponed keyboard-interactive/pam for invalid user admin from 75.149.180.141 port 65264 ssh2 [preauth]
#Aug 16 21:57:30 nada sshd[26976]: Postponed keyboard-interactive/pam for invalid user support from 103.207.36.244 port 59302 ssh2 [preauth]
\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Postponed keyboard-interactive/pam for invalid user support from [.:[:digit:]]+ port [[:digit:]]+ ssh2 \[preauth\]
# #

2
testlog
View File

@@ -211,3 +211,5 @@ Jun 25 12:58:28 kvarnen freshclam[15554]: WARNING: getfile: Unknown response fro
Jun 25 16:58:32 kvarnen freshclam[15554]: WARNING: getfile: daily-21788.cdiff not found on db.local.clamav.net (IP: 217.19.16.188) Jun 25 16:58:32 kvarnen freshclam[15554]: WARNING: getfile: daily-21788.cdiff not found on db.local.clamav.net (IP: 217.19.16.188)
Jun 25 17:16:28 nada sshd[7066]: input_userauth_request: invalid user secret\\r [preauth] Jun 25 17:16:28 nada sshd[7066]: input_userauth_request: invalid user secret\\r [preauth]
Jun 25 17:26:26 nada sshd[7935]: input_userauth_request: invalid user user\\r [preauth] Jun 25 17:26:26 nada sshd[7935]: input_userauth_request: invalid user user\\r [preauth]
Aug 16 19:28:06 nada sshd[12135]: Postponed keyboard-interactive/pam for invalid user admin from 75.149.180.141 port 65264 ssh2 [preauth]
Aug 16 21:57:30 nada sshd[26976]: Postponed keyboard-interactive/pam for invalid user support from 103.207.36.244 port 59302 ssh2 [preauth]