Bug 202055 - [ssh] [patch] Extra IP number information for failed (anonymous) connects
Summary: [ssh] [patch] Extra IP number information for failed (anonymous) connects
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Some People
Assignee: Dag-Erling Smørgrav
URL:
Keywords: patch
Depends on:
Blocks:
 
Reported: 2015-08-03 08:32 UTC by Willem Jan Withagen
Modified: 2016-01-20 12:18 UTC (History)
1 user (show)

See Also:


Attachments
log ip-numbers for failed socket connect attempts (735 bytes, patch)
2015-08-03 08:32 UTC, Willem Jan Withagen
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Willem Jan Withagen 2015-08-03 08:32:13 UTC
Created attachment 159484 [details]
log ip-numbers for failed socket connect attempts

Running ssh, logfiles are swamped with lines like:
fatal: Read from socket failed: Connection reset by peer [preauth]

Which is rather useless for tools like sshguard and/or fail2ban

But this patch changes this info to:
Aug  2 19:37:32 zfs sshd[19444]: Read from socket failed: 218.2.22.36 [preauth]
Aug  2 19:37:32 zfs sshd[19444]:fatal: Read from socket failed: Connection reset by peer [preauth]

I decided to keep the older log line as well, to keep consistent what was there already. I do not know if any logfile analysers care about this line.

Thus giving other tools to opportunity to act on (now) known abuse ip-numbers.

--WjW

PS: not sure if the patch goes to FreeBSd, or perhaps upstream to openssh?