Date: Tue, 4 Aug 2020 07:22:42 +0200 From: Matthias Fechner <idefix@fechner.net> To: freebsd-questions@freebsd.org Subject: Re: SSH log lines Message-ID: <745dc612-d5a4-1e06-89bb-8df5dfbd7e1f@fechner.net> In-Reply-To: <09256F5E-469C-402B-94DC-3C07F8AC29ED@kreme.com> References: <09256F5E-469C-402B-94DC-3C07F8AC29ED@kreme.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Am 03.08.2020 um 21:37 schrieb @lbutlr: > When some moon tires to login to an account like root, ssh does n’t log the IP address in the failure line as it does with non-existent users. > > sshd[99328] error: PAM: Authentication error for root from vps-94314d13.vps.ovh.ca > sshd[99328] Connection closed by authenticating user root 139.99.236.165 port 46226 [preauth] > > sshd[7202] Invalid user pi from 2.232.248.6 port 46438 > > Is there anyway that I can change this so that the IP address appears not eh same line as the Authentication error, it would make my blacklisting these people much easier. try fail2ban, it can handle all of this correctly. Gruß Matthias -- "Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the universe trying to produce bigger and better idiots. So far, the universe is winning." -- Rich Cook
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?745dc612-d5a4-1e06-89bb-8df5dfbd7e1f>