From owner-freebsd-current@FreeBSD.ORG Thu Mar 16 13:03:20 2006 Return-Path: X-Original-To: freebsd-current@freebsd.org Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id AEC4E16A401 for ; Thu, 16 Mar 2006 13:03:20 +0000 (UTC) (envelope-from dmitry@atlantis.dp.ua) Received: from postman.atlantis.dp.ua (postman.atlantis.dp.ua [193.108.47.1]) by mx1.FreeBSD.org (Postfix) with ESMTP id BB4C643D5D for ; Thu, 16 Mar 2006 13:03:19 +0000 (GMT) (envelope-from dmitry@atlantis.dp.ua) Received: from smtp.atlantis.dp.ua (smtp.atlantis.dp.ua [193.108.46.231]) by postman.atlantis.dp.ua (8.13.1/8.13.1) with ESMTP id k2GD38Qs001672 for ; Thu, 16 Mar 2006 15:03:08 +0200 (EET) (envelope-from dmitry@atlantis.dp.ua) Date: Thu, 16 Mar 2006 15:03:08 +0200 (EET) From: Dmitry Pryanishnikov To: freebsd-current@freebsd.org Message-ID: <20060316145826.M96629@atlantis.atlantis.dp.ua> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Subject: src/etc/periodic/security/800.loginfail X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2006 13:03:20 -0000 Hello! I've noticed the recent addition in this file in order to detect "(fail|invalid|bad|illegal)" in auth.log files. I wonder would it be useful to also detect SSH.COM's server "Refusing connection" messages here. They have the following format: Mar 16 14:56:55 test3 sshd2[74522]: Refusing connection from "192.168.1.145". Too many open connections (max 2, now open 2). Sincerely, Dmitry -- Atlantis ISP, System Administrator e-mail: dmitry@atlantis.dp.ua nic-hdl: LYNX-RIPE