Getting IP's added to log entry

From: Matt Pearce (matt_at_00pearceits.com.au)
Date: 11/28/05 

Date: Tue, 29 Nov 2005 01:44:09 +1100

Hi All,

As you are all aware there are bots scanning servers for sshd service
and trying combinations of username/password to gain entry. To counter
this I have added AllowUsers to my sshd_config with only one entry in it
(not root). My log output for sshd to auth.log only logs this:-

sshd[321]: User root not allowed because not listed in AllowUsers

when anyone else but the allowed users name is used to try and gain
entry. I would like this log message to reflect the ip the failed
attempt came from as my bruteforceblocker will then take the ip and sent
it to a table for my firewall that will block it from connection to me
again on my ssh port.

So is it easy to modify sshd to do this or is someone with no
programming knowledge way out of there depth ??

Matt.

Relevant Pages

  • Re: root login
    ... > I cant remember how I did it apart from it was a single line entry ... If you're talking about logging as root remotely using ssh, ... reload config of sshd by writing: ... *http://eggwiki.takeda.tk - pomoc w używaniu botów po polsku* ...
    (comp.unix.bsd.freebsd.misc)
  • How to have sshd log IP numbers instead of reverse lookups
    ... I was looking at /var/log/auth.log and saw an entry of the form: ... I wish to have an IP number logged where sshd has instead logged ... Reading sshd's man page and sshd_config's man page, ... To unsubscribe, ...
    (freebsd-questions)
  • Re: sshd_config 1.35 commit
    ... >> authentication in default sshd is a stupid idea? ... >> entry in UPDATING would have been nice, so people don't get locked out after ... maybe it isn't so bad and an entry to UPDATING might ...
    (freebsd-current)
  • Re: Weird ssh behaviour with 5.2
    ... > I would guess that is due to a reverse lookup of the IP address you're ... > may solve your problem (sshd will still do name lookups in some cases). ... I don't run any DNS on this pSeries, so the nslookup isn't likley the ... /etc.netsvc.conf just has a hosts=local entry. ...
    (comp.unix.aix)