[patch] Patch for /usr/share/logwatch/scripts/services/sshd

sshd.diff (text/plain), 2.64 KB, created by Jesus de Santos Garcia on 2006-07-24 17:42:00 UTC

--- sshd	2006-07-25 01:14:32.000000000 +0200
+++ sshd.fixed	2006-07-25 02:26:46.000000000 +0200
@@ -125,7 +125,9 @@
 my %PostPonedAuth = ();
 my %LockedAccount = ();
 my %AllowUsers = ();
+my %AllowGroups = ();
 my %NoShellUsers = ();
+my %ShellNotExecutableUsers = ();
 my %DeprecatedOption = ();
 my %MisMatch = ();
 my @BadRSA = ();
@@ -253,7 +255,7 @@
       $BadLogins{$Host}{"$User/$Method"}++;
    } elsif ($ThisLine =~ s/^(log: )?Could not reverse map address ([^ ]*).*$/$2/) {
       $NoRevMap{$ThisLine}++;
-   } elsif ( my ($Address) = ($ThisLine =~ /^reverse mapping checking getaddrinfo for ([^ ]*) failed - POSSIBLE BREAKIN ATTEMPT!/)) {
+   } elsif ( my ($Address) = ($ThisLine =~ /^reverse mapping checking getaddrinfo for ([^ ]*) failed - POSSIBLE BREAK-IN ATTEMPT!/)) {
       $NoRevMap{$Address}++;
    } elsif ( my ($IP,$Address) = ($ThisLine =~ /^Address ([^ ]*) maps to ([^ ]*), but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT!/)) {
       $NoRevMap{"$Address($IP)"}++;
@@ -288,8 +290,12 @@
       $LockedAccount{$User}++;
    } elsif ( my ($User) = ($ThisLine =~ /^User ([^ ]*) not allowed because not listed in AllowUsers/)) {
       $AllowUsers{$User}++;
+   } elsif ( my ($User) = ($ThisLine =~ /^User ([^ ]*) from ([^ ]*) not allowed because none of user's groups are listed in AllowGroups/)) {
+      $AllowGroups{$User}++;    
    } elsif ( ($User) = ($ThisLine =~ /^User ([^ ]*) not allowed because shell (\S+) does not exist/)) {
       $NoShellUsers{$User}++;
+   } elsif ( ($User) = ($ThisLine =~ /^User ([^ ]*) not allowed because shell (\S+) is not executable/)) {
+      $ShellNotExecutableUsers{$User}++;
    } elsif ( my ($IP) = ($ThisLine =~ /^scanned from ([^ ]*)/) ) {
       push @Scanned, $IP;
    } elsif ( my ($Line,$Option) = ($ThisLine =~ /^rexec line (\d+): Deprecated option (.*)$/)) {
@@ -427,6 +433,13 @@
    }
 }
 
+if (keys %AllowGroups) {
+   print "\nLogin attempted when not in AllowGroups list:\n";
+   foreach my $User (sort {$a cmp $b} keys %AllowGroups) {
+      print "   $User : $AllowGroups{$User} Time(s)\n";
+   }
+}
+
 if (keys %NoShellUsers) {
    print "\nLogin attempted when shell does not exist:\n";
    foreach my $User (sort {$a cmp $b} keys %NoShellUsers) {
@@ -434,6 +447,13 @@
    }
 }
 
+if (keys %ShellNotExecutableUsers) {
+   print "\nLogin attempted when shell is not executable:\n";
+   foreach my $User (sort {$a cmp $b} keys %ShellNotExecutableUsers) {
+      print "   $User : $ShellNotExecutableUsers{$User} Time(s)\n";
+   }
+}
+
 if ((keys %LoginLock) and ($Detail >= 5)) {
    print "\nUser login attempt when nologin was set:\n";
    foreach my $User (sort {$a cmp $b} keys %LoginLock) {