fredrik/logcheck
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fler preauth

Browse Source
This commit is contained in:
fredrik
2024-04-01 09:59:59 +02:00
parent 5ebeb3e068
commit 6d904dfb42
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
logcheck-fw-sshd
View File

@@ -191,3 +191,6 @@
#Feb 5 01:55:57 nada sshd[27887]: Disconnecting invalid user ec2-user 183.107.58.230 port 63999: Too many authentication failures [preauth]
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnecting invalid user [-[:alnum:]]+ [.:[:digit:]]+ port [[:digit:]]+: Too many authentication failures \[preauth\]
#Mar 31 19:21:30 nada sshd[18955]: Disconnected from invalid user 212.70.149.150 port 27437 [preauth]
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnected from invalid user ([-[:alnum:]]+)? [.:[:digit:]]+ port [[:digit:]]+ \[preauth\]

2
testlog
View File

@@ -787,6 +787,8 @@ Jan 21 09:45:23 nada sshd[14807]: error: kex_protocol_error: type 20 seq 2 [prea
Mar 27 21:52:08 nada sshd[31920]: Received disconnect from 212.70.149.150 port 19201:11: Bye [preauth]
Mar 27 23:07:45 nada sshd[951]: Received disconnect from 212.70.149.150 port 36664:11: Bye [preauth]
Mar 31 08:57:09 nada sshd[32339]: Received disconnect from 185.224.128.34 port 38898:11: end [preauth]
Mar 31 19:21:30 nada sshd[18955]: Disconnected from invalid user 212.70.149.150 port 27437 [preauth]
Mar 31 20:28:36 nada sshd[21092]: Disconnected from invalid user 212.70.149.150 port 28708 [preauth]
Aug 23 18:39:24 nada fredrik[1713]: Kontrollrad. Syns detta har vi problem...
Aug 23 18:39:24 nada fredrik[1713]: Sista raden