######################################################## # Please file all bug reports, patches, and feature # requests under: # https://sourceforge.net/p/logwatch/_list/tickets # Help requests and discusion can be filed under: # https://sourceforge.net/p/logwatch/discussion/ ######################################################## ####################################################### ## Copyright (c) 2008 Kirk Bauer ## Covered under the included MIT/X-Consortium License: ## http://www.opensource.org/licenses/mit-license.php ## All modifications and contributions by other persons to ## this script are assumed to have been donated to the ## Logwatch project and thus assume the above copyright ## and licensing terms. If you want to make contributions ## under your own copyright or a different license this ## must be explicitly stated in the contribution an the ## Logwatch project reserves the right to not accept such ## contributions. If you have made significant ## contributions to this script and want to claim ## copyright please contact logwatch-devel@lists.sourceforge.net. ######################################################### use strict; use Logwatch ':all'; my $Debug = $ENV{'LOGWATCH_DEBUG'} || 0; my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0; my $IgnoreHost = $ENV{'sshd_ignore_host'} || ""; my $RefusedConnectionsThreshold = $ENV{'refused_connections_threshold'} || 0; my $IllegalUsersThreshold = $ENV{'illegal_users_threshold'} || 0; DoLookup( $ENV{'sshd_ip_lookup'} ); my $DebugCounter = 0; #Init String Containers my ( $Action, $Address, $Addresses, $BytesRead, $BytesWritten, $ClientVer, $Code, $Dir, $EmptyUser, $Error, $File, $FingerP, $Flags, $From, $Host, $IP, $IlegUser, $InvaUser, $Key, $Line, $Method, $Mode, $Modtime, $Offer, $Option, $Perm, $Pom, $Pom1, $Pom2, $Port, $Prio, $Reason, $Received, $Sent, $To, $User, $Why, $realm, $user, $hr, $min, $sec, $conn, ); # No sense in running if 'sshd' doesn't even exist on this system... #unless (( -f "/usr/sbin/sshd" ) or ( -f "/usr/local/sbin/sshd") or ( -f "/usr/lib/ssh/sshd")) { # exit (0); #} my %Users = (); my %IllegalUsers = (); my %TooManyFailures = (); my %NoIdent = (); my %BindFailed = (); my %BadLogins = (); my %NoRevMap = (); my %RefusedConnections = (); my %RefusedAuthentication = (); my %NegotiationFailed = (); my %DisconnectReceived = (); my %RootLogin = (); my %PamReleaseFail = (); my %PamError = (); my %PamChroot = (); my %PamDeny = (); my %ShadowInfo = (); my %TTYModesFail = (); my %LoginLock = (); my %PostPonedAuth = (); my %LockedAccount = (); my %AllowUsers = (); my %DenyUsers = (); my %AllowGroups = (); my %DenyGroups = (); my %NoGroups = (); my %NoShellUsers = (); my %ShellNotExecutableUsers = (); my %DeprecatedOption = (); my %MisMatch = (); my %KrbAutFail = (); my %KrbAutErr = (); my %KrbErr = (); my @Scanned = (); my %OtherList = (); my %ChmodErr = (); my %ChownErr = (); my %Krb_realm = (); my %ConnectFailed = (); my %Chroot = (); my %CloseDir = (); my %CloseFileReadWrite = (); my %OpenDir = (); my %OpenFile = (); my %RealPath = (); my %Session = (); my %SetModtime = (); my %Stat = (); my %ClientVers = (); my $sftpRequests = 0; my $NetworkErrors = 0; my $Kills = 0; my $Starts = 0; my $StatusNoSuchFile = 0; my $BytesSent = 0; my $BytesReceived = 0; my $NoCipher = 0; my $MaxStartupsThrottling = 0; my $MaxStartupsDrops = 0; my $MaxStartupsTime = 0; my %MaxStartupsIPs = (); my $multiline = 0; if ( $Debug >= 5 ) { print STDERR "\n\nDEBUG: Inside SSHD Filter \n\n"; $DebugCounter = 1; } while (defined(my $ThisLine = )) { if ( $Debug >= 5 ) { print STDERR "DEBUG($DebugCounter): $ThisLine"; $DebugCounter++; } chomp($ThisLine); if ( $multiline ) { if ( ($Host) = ($ThisLine =~ /^banner exchange: Connection from ([^ ]+)(?: port \d+)?:/) ) { $NegotiationFailed{$Reason}{$Host}{$Offer}++; } elsif ( ($Host) = ($ThisLine =~ /^Connection reset by ([^ ]+)(?: port \d+)?/) ) { $NegotiationFailed{$Reason}{$Host}{$Offer}++; } } $multiline = 0; if ( ($ThisLine =~ /^pam_succeed_if: requirement "uid < 100" (not|was) met by user /) or ($ThisLine =~ /^pam_succeed_if\(.*?\): requirement "uid >= 1000" (not|was) met by user /) or ($ThisLine =~ m/^(log: )?$/ ) or ($ThisLine =~ m/^(log: )?\^\[\[60G/ ) or ($ThisLine =~ m/^(log: )? succeeded$/ ) or ($ThisLine =~ m/^(log: )?Closing connection to/) or ($ThisLine =~ m/^(log: )?Starting sshd:/ ) or ($ThisLine =~ m/^(log: )?sshd \-TERM succeeded/ ) or ($ThisLine =~ m/^Bad protocol version identification .*:? [\d.]+/ ) or ($ThisLine =~ m/^Bad protocol version identification.*Big-Brother-Monitor/ ) or ($ThisLine =~ m/^Connection closed by/) or ($ThisLine =~ m/^Disconnecting: Command terminated on signal \d+/) or ($ThisLine =~ m/^Disconnecting: server_input_channel_req: unknown channel -?\d+/) or ($ThisLine =~ m/^connect from \d+\.\d+\.\d+\.\d+/) or ($ThisLine =~ m/^fatal: Timeout before authentication/ ) or ($ThisLine =~ m/^fatal: no hostkey alg/) or ($ThisLine =~ m/Connection from .* port /) or ($ThisLine =~ m/Postponed (keyboard-interactive|publickey) for [^ ]+ from [^ ]+/) or ($ThisLine =~ m/Read from socket failed/) or ($ThisLine =~ m/sshd startup\s+succeeded/) or ($ThisLine =~ m/sshd shutdown\s+succeeded/) or ($ThisLine =~ m/^Found matching [DR]SA key: /) or ($ThisLine =~ m/^error: key_read: type mismatch: encoding error/) or ($ThisLine =~ m/^channel_lookup: -?\d+: bad id/) or ($ThisLine =~ m/^error: channel \d+: chan_read_failed for istate/) or # Result of setting PermitRootLogin to forced-commands-only ($ThisLine =~ m/^Root login accepted for forced command\.( \[preauth\])?$/) or # usually followed by a session opened for user ($ThisLine =~ m/^pam_krb5\[\d+\]: authentication succeeds for /) or ($ThisLine =~ m/^nss_ldap: reconnect/) or ($ThisLine =~ /gkr-pam: gnome-keyring-daemon started properly/) or ($ThisLine =~ /gkr-pam: unable to locate daemon control file/) or ($ThisLine =~ m/^pam_ldap: error trying to bind as user "[^"]+" \(Invalid credentials\)/) or ($ThisLine =~ m/^pam_ldap: ldap_starttls_s: Can't contact LDAP server/) or ($ThisLine =~ m/^pam_sss\(sshd:.*\)/) or ($ThisLine =~ m/^\(pam_unix\) .*/) or ($ThisLine =~ m/^pam_unix\(.*:.*\)/) or ($ThisLine =~ m/^pam_unix_auth:/) or ($ThisLine =~ m/^pam_sepermit\(.*:.*\)/) or ($ThisLine =~ /pam_krb5: authentication succeeds for `([^ ]*)'/) or ($ThisLine =~ /pam_succeed_if\(.*:.*\): error retrieving information about user [a-zA-Z]*/ ) or ($ThisLine =~ /pam_winbind\(sshd:account\): user .* granted access/) or ($ThisLine =~ /pam_winbind\(sshd:account\): user .* OK/) or ($ThisLine =~ /pam_systemd\(sshd:session\): Moving/) or ($ThisLine =~ /pam_systemd\(sshd:session\): .*: Connection reset by peer/) or ($ThisLine =~ /userauth_finish: .*: Connection reset by peer/) or ($ThisLine =~ /PAM \d+ more authentication failures?;/) or ($ThisLine =~ /^PAM service\(sshd\) ignoring max retries;/) or ($ThisLine =~ /^Failed keyboard-interactive for from/ ) or ($ThisLine =~ /^Keyboard-interactive \(PAM\) userauth failed/ ) or ($ThisLine =~ /^debug1: /) or ($ThisLine =~ /Set \/proc\/self\/oom_(score_)?adj (from -?\d )?to -?\d/ ) or ($ThisLine =~ /Starting session: (forced-command|subsystem|shell|command)/ ) or ($ThisLine =~ /Found matching \w+ key:/ ) or ($ThisLine =~ /User child is on pid \d/ ) or ($ThisLine =~ /Nasty PTR record .* is set up for [\da-fA-F.:]+(?:%\S+)?, ignoring/) or ($ThisLine =~ /Exiting on signal / ) or ($ThisLine =~ /Disconnected from [\da-fA-F.:]*(?:%\S+)? port \d*/ ) or ($ThisLine =~ /Disconnected from user \S+ [\da-fA-F.:]*(?:%\S+)? port \d*/ ) or ($ThisLine =~ /Disconnected from (authenticating|invalid) user \S+ [\da-fA-F.:]*(?:%\S+)? port \d*/ ) or ($ThisLine =~ /Disconnecting( (authenticating|invalid) user .* port \d+)?: Too many authentication failures \[preauth\]/ ) or ($ThisLine =~ /Disconnecting( (authenticating|invalid) user .* port \d+)?: Change of username or service not allowed: .* \[preauth\]/ ) or ($ThisLine =~ /Failed to release session: Interrupted system call/) or ($ThisLine =~ /Close session: user /) or #($ThisLine =~ /error: .*: banner line contains invalid characters/) or #($ThisLine =~ /past MaxStartups/) or #($ThisLine =~ /exited MaxStartups throttling/) or # user already accounted for in other statement ($ThisLine =~ /^input_userauth_request: (illegal|invalid) user (.*)(?: \[preauth\])?$/ ) or 0 # This line prevents blame shifting as lines are added above ) { # Ignore these } elsif ( ($Method,$User,$Host,$Port,$Key,$FingerP) = ($ThisLine =~ /^Accepted (\S+) for ((?:invalid user )?\S+) from ([\d\.:a-f]+)(?:%\w+)? port (\d+) ssh[12](?:: (\w+) (.+))?/) ) { if ($Debug >= 5) { print STDERR "DEBUG: Found -$User logged in from $Host using $Method ($Key)\n"; } if ($Detail >= 20) { $Users{$User}{$Host}{$Method . ($Key ? "($Key" . (($Detail >= 30) ? " " . $FingerP : "") . ")" : "")}++; } else { if ( $Host !~ /$IgnoreHost/ ) { $Users{$User}{$Host}{"(all)"}++; } } } elsif ( ($Method, undef,$User,$Host,$Port) = ($ThisLine =~ m/^Failed (\S+) for (illegal|invalid) user (.*) from ([^ ]+) port (\d+)/ ) ) { #openssh $IllegalUsers{$Host}{$User}++; } elsif ( ($User) = ( $ThisLine =~ /Disconnecting: Too many authentication failures for ([^ ]+)/)) { $TooManyFailures{$User}++; } elsif ( ($User) = ( $ThisLine =~ /error: maximum authentication attempts exceeded for ([^ ]+) from [^ ]+ port \d+ ssh2 \[preauth\]/)) { $TooManyFailures{$User}++; } elsif ( ($User,$Host) = ( $ThisLine =~ /error: maximum authentication attempts exceeded for invalid user ([^ ]+) from ([^ ]+) port \d+ ssh2 \[preauth\]/)) { $IllegalUsers{$Host}{$User}++; } elsif ( $ThisLine =~ m/^(fatal: )?Did not receive ident(ification)? string from (\S+)/ ) { # ssh/openssh my $name = LookupIP($3); $NoIdent{$name}++; } elsif ( ($Host) = ($ThisLine =~ /Could not write ident string to ([^ ]+)$/ )) { my $name = LookupIP($Host); $NoIdent{$name}++; } elsif ( ($ThisLine =~ m/^(?:error:.*|fatal:) Connection closed by remote host/ ) or ($ThisLine =~ m/^(|fatal: )Read error from remote host(| [^ ]+): Connection reset by peer/ ) or ($ThisLine =~ m/^error: .*: read: Connection reset by peer/ ) or ($ThisLine =~ m/^Read error from remote host [^ ]+: (Connection timed out|No route to host)/ ) or ($ThisLine =~ m/^fatal: Read from socket failed: No route to host/) or ($ThisLine =~ m/^fatal: Write failed: Network is unreachable/ ) or ($ThisLine =~ m/^fatal: Write failed: Broken pipe/) or ($ThisLine =~ m/^fatal: Write failed: Connection reset by peer/) or ($ThisLine =~ m/^Connection reset by/) or ($ThisLine =~ m/^channel \d+: open failed: (?:connect failed: Channel open failed\.|administratively prohibited: open failed)/) or ($ThisLine =~ m/^session_input_channel_req: no session \d+ req window-change/) or ($ThisLine =~ m/^error: chan_shutdown_read failed for .+/) ) { $NetworkErrors++; } elsif ( $ThisLine =~ m/^(log: )?Received (signal 15|SIG...); (terminating|restarting)\./) { #ssh/openssh $Kills++; if ( $Debug >= 5 ) { print STDERR "DEBUG: Found -Signal 15 Terminating- line\n"; } } elsif ( $ThisLine =~ m/^(log: )?Server listening on( [^ ]+)? port \d+/ ) { #ssh/openssh $Starts++; if ( $Debug >= 5 ) { print STDERR "DEBUG: Found -Listening on port 22- line\n"; } } elsif ( ($Port,$Address,$Reason) = ($ThisLine =~ /^error: Bind to port ([^ ]+) on ([^ ]+) failed: (.+).$/ )) { my $Temp = "$Address port $Port ($Reason)"; # Failed to bind on 0.0.0.0 likely due to configured "ListenAddress" # on both IPv4 and IPv6 unless ($Address =~ /^0.0.0.0$/) { $BindFailed{$Temp}++; } } elsif ( $ThisLine =~ m/^(log: )?Generating .* \w+ key\./ ) { # ssh/openssh # Don't care about this... if ( $Debug >= 5 ) { print STDERR "DEBUG: Found -Generating RSA key- line\n"; } } elsif ( $ThisLine =~ m/^packet_set_maxsize: /) { if ( $Debug >= 5 ) { print STDERR "DEBUG: Found -packet_set_maxsize- line\n"; } } elsif ( $ThisLine =~ m/^(log: )?\w+ key generation complete\./ ) { # ssh/openssh # Don't care about this... if ( $Debug >= 5 ) { print STDERR "DEBUG: Found -Keygen complete- line\n"; } } elsif ( ($Method,$User,$Host,undef) = ( $ThisLine =~ m/^Failed (\S+) for (\S+) from ([^ ]+) port (\d+)/ ) ) { #openssh # depending on log mode, openssh may not report these in connection context. if ( $Debug >= 5 ) { print STDERR "DEBUG: Found -Failed login- line\n"; } $BadLogins{$Host}{"$User/$Method"}++; } elsif ($ThisLine =~ s/^(log: )?Could not reverse map address ([^ ]*).*$/$2/) { $NoRevMap{$ThisLine}++; } elsif ( ($Address) = ($ThisLine =~ /^reverse mapping checking getaddrinfo for (\S+( \[\S+\])?) failed - POSSIBLE BREAK-IN ATTEMPT!/)) { $NoRevMap{$Address}++; } elsif ( ($IP,$Address) = ($ThisLine =~ /^Address ([^ ]*) maps to ([^ ]*), but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!/)) { $NoRevMap{"$Address($IP)"}++; } elsif ( (undef,$Address) = ($ThisLine =~ /^warning: ([^ ]*), line \d+: can't verify hostname: getaddrinfo\(([^ ]*), AF_INET\) failed$/)) { $NoRevMap{$Address}++; } elsif ( (undef,$Addresses) = ($ThisLine =~ /^warning: ([^ ]*), line \d+: host [^ ]* mismatch: (.*)$/)) { $MisMatch{$Addresses}++; } elsif ( $ThisLine =~ m/subsystem request for sftp/ ) { $sftpRequests++; } elsif ( $ThisLine =~ m/refused connect from (.*)$/ ) { $RefusedConnections{$1}++; } elsif ( ($Reason) = ($ThisLine =~ /^Authentication refused: (.*)$/ ) ) { $RefusedAuthentication{$Reason}++; } elsif ( (undef,$Host,$Port,$Reason,$Offer) = ($ThisLine =~ /^(fatal: )?Unable to negotiate with ([^ ]+)( port \d+)?: (.*)\. Their offer: (.*) \[preauth\]$/) ) { $NegotiationFailed{$Reason}{$Host}{$Offer}++; } elsif ( ($Reason,$Host,$Offer) = ($ThisLine =~ /^(Protocol major versions differ) for ([^ ]+)(?: port \d+)?: (.*)$/) ) { $NegotiationFailed{$Reason}{$Host}{$Offer}++; } elsif ( ($Reason,$Offer) = ($ThisLine =~ /^error: (Protocol major versions differ): (.*)$/) ) { $multiline++; } elsif ( ($Reason,$Offer) = ($ThisLine =~ /^error: (kex_exchange_identification): (.*)$/) ) { $multiline++; } elsif ( ($Reason,$Offer) = ($ThisLine =~ /^error: (kex protocol error): (.*)$/) ) { $multiline++; } elsif ( ($Prio,$Host,$Port,$Code,$Reason) = ($ThisLine =~ /^(error: )?Received disconnect from ([^ ]*)( port \d+)?: ?(\d+): (.*)$/)) { # Reason 11 ({SSH,SSH2}_DISCONNECT_BY_APPLICATION) is expected, and logged at severity level INFO if (($Reason =~ /preauth/) || ($Code != 11) || ($Detail >= 30)) { $DisconnectReceived{$Reason}{$Host}++; } } elsif ( ($Host) = ($ThisLine =~ /^ROOT LOGIN REFUSED FROM ([^ ]*)$/)) { $RootLogin{$Host}++; } elsif ( ($Error) = ($ThisLine =~ /^Cannot release PAM authentication\[\d\]: (.*)$/)) { $PamReleaseFail{$Error}++; } elsif ( ($Error) = ($ThisLine =~ /^pam_systemd\(sshd:session\): Failed to release session: (.*)$/)) { $PamReleaseFail{$Error}++; } elsif ( ($Error) = ( $ThisLine =~ m/^error: PAM: (.*)$/)) { $PamError{$Error}++; } elsif ( ($Error) = ( $ThisLine =~ m/pam_systemd\(sshd:session\): (Failed to create session: .*)$/)) { $PamError{$Error}++; } elsif ( ($Reason) = ( $ThisLine =~ m/pam_chroot\(.+\):\s+([^:])/)) { $PamChroot{$Reason}++; } elsif ( ($Error) = ( $ThisLine =~ m/^error: Could not get shadow information for (.*)$/)) { $ShadowInfo{$Error}++; } elsif ( ($Reason) = ($ThisLine =~ /^Setting tty modes failed: (.*)$/)) { $TTYModesFail{$Reason}++; } elsif ( ($User,undef) = ($ThisLine =~ /^User ([^ ]*) not allowed because ([^ ]*) exists$/)) { $LoginLock{$User}++; } elsif ( ($Method,$InvaUser,$IlegUser,$EmptyUser,$User,$Host) = ($ThisLine =~ /^Postponed ([^ ]*) for ((invalid user) [^ ]*|(illegal user) [^ ]*|([^ ]*)) from ([^ ]*) port \d+ ssh/)) { $PostPonedAuth{"$User/$Method"}{$Host}++; if ($IlegUser =~ /illegal user/) {$IllegalUsers{$Host}{$User}++;} } elsif ( ($User) = ($ThisLine =~ /^User ([^ ]*) not allowed because account is locked/)) { $LockedAccount{$User}++; } elsif ( ($User) = ($ThisLine =~ /^User ([^ ]*) from (?:[^ ]*) not allowed because not listed in AllowUsers/)) { $AllowUsers{$User}++; } elsif ( ($User) = ($ThisLine =~ /^User ([^ ]*)( from [0-9.]*)? not allowed because listed in DenyUsers/)){ $DenyUsers{$User}++; } elsif ( ($User) = ($ThisLine =~ /^User ([^ ]*)( from [0-9.]*)? not allowed because not in any group/)) { $NoGroups{$User}++; } elsif ( ($User) = ($ThisLine =~ /^User ([^ ]*)( from [^ ]*)? not allowed because a group is listed in DenyGroups/)) { $DenyGroups{$User}++; } elsif ( ($User) = ($ThisLine =~ /^User ([^ ]*) from ([^ ]*) not allowed because none of user's groups are listed in AllowGroups/)) { $AllowGroups{$User}++; } elsif ( ($User) = ($ThisLine =~ /^User ([^ ]*) not allowed because shell (\S+) does not exist/)) { $NoShellUsers{$User}++; } elsif ( ($User) = ($ThisLine =~ /^User ([^ ]*) not allowed because shell (\S+) is not executable/)) { $ShellNotExecutableUsers{$User}++; } elsif ( ($User) = ($ThisLine =~ /^fatal: Access denied for user ([^ ]+) by PAM account configuration \[preauth\]/)) { $PamDeny{$User}++; } elsif ( ($IP) = ($ThisLine =~ /^scanned from ([^ ]*)/) ) { push @Scanned, $IP; } elsif ( (undef,$Line,$Option) = ($ThisLine =~ /^re(xec|process config) line (\d+): Deprecated option (.*)$/)) { $DeprecatedOption{"$Option - line $Line"}++; } elsif ( ($Pom1,$Pom2,$User) = ($ThisLine =~ /pam_krb5(\[\d*\])?: authentication fails for (`|')([^ ]*)'/)) { $KrbAutFail{$User}++; } elsif ( ($Error) = ($ThisLine =~ /pam_krb5: authenticate error: (.*)$/)) { $KrbAutErr{$Error}++; } elsif ( ($ThisLine =~ /pam_krb5: unable to determine uid\/gid for user$/)) { $KrbAutErr{"unable to determine uid/gid for user"}++; } elsif ( ($Error) = ($ThisLine =~ /pam_krb5: error removing file (.*)$/)) { $KrbErr{"error removing file " . $Error}++; } elsif ( ($Pom,$Error) = ($ThisLine =~ /pam_krb5(\[\d*\]): error resolving user name '[^ ]*' to uid\/gid pai/)) { $KrbErr{"error resolving user name '$Error' to uid\/gid pai"}++; } elsif ( (undef,$User,$Host) = ($ThisLine =~ m/^(Illegal|Invalid) user (.*) from ([^ ]+)/ )) { if ($User eq "") { $User = "{undefined}"; } $IllegalUsers{$Host}{$User}++; } elsif (($File,$Perm,$Why) = ($ThisLine =~ /error: chmod (.*) (.*) failed: (.*)/)) { $ChmodErr{"$File,$Perm,$Why"}++; } elsif (($File,$From,$To,$Why) = ($ThisLine =~ /error: chown (.*) (.*) (.*) failed: (.*)/)) { $ChownErr{"$File,$From,$To,$Why"}++; } elsif (($user,$realm) = ($ThisLine =~ /Authorized to ([^ ]+), krb5 principal \1@([^ ]+) \((?:krb5_kuserok|ssh_gssapi_krb5_cmdok)\)/)) { $Krb_realm{$realm}{$user}++; } elsif (($Action,$User) = ($ThisLine =~ /^session ((?:open|clos)ed) for local user (\S+) from /)) { $Session{"Action,$User"}++; } elsif ($ThisLine =~ /^sent status No such file$/) { $StatusNoSuchFile++; } elsif (($File,$Flags,$Mode) = ($ThisLine =~ /^open "(.*)" flags (\S+) mode (\d+)/ )) { $OpenFile{"$File:$Flags:$Mode"}++; } elsif (($File,$BytesRead,$BytesWritten) = ($ThisLine =~ /^close "(.*)" bytes read (\d+) written (\d+)/ )) { $CloseFileReadWrite{"$File,$BytesRead,$BytesWritten"}++; } elsif (($Sent,$Received) = ($ThisLine =~ /^Transferred: sent (\d+), received (\d+) bytes$/ )) { $BytesSent += $Sent; $BytesReceived += $Received; } elsif (($File,$Modtime) = ($ThisLine =~ /^set "(.*)" modtime (\d+-\d+:\d+:\d+)$/ )) { $SetModtime{"$Modtime,$File"}++; } elsif (($Dir) = ($ThisLine =~ /^opendir "(.*)"$/ )) { $OpenDir{$Dir}++; } elsif (($Dir) = ($ThisLine =~ /^closedir "(.*)"$/ )) { $CloseDir{$Dir}++; } elsif (($File) = ($ThisLine =~ /^realpath "(.*)"$/ )) { $RealPath{$File}++; } elsif (($File) = ($ThisLine =~ /^stat name "(.*)"$/ )) { $Stat{$File}++; } elsif (($Dir) = ($ThisLine =~ /^Changed root directory to "(.*)"/ )) { $Chroot{$Dir}++; } elsif (($ClientVer) = ($ThisLine =~ /^received client version (\S+)/ )) { $ClientVers{$ClientVer}++; } elsif (($Host,$Port) = ($ThisLine =~ /^error: connect_to (\S+) port (\d+): failed\.$/)) { $ConnectFailed{"$Host port $Port"}++; } elsif ($ThisLine =~ /^fatal: no matching cipher found: /) { $NoCipher++; } elsif ($ThisLine =~ /beginning MaxStartups throttling/) { $MaxStartupsThrottling++; } elsif (($IP) = ($ThisLine =~ /drop connection #\d+ from \[(\S+)\]:\d+ on \[\S+\]:\d+ past MaxStartups/)) { $MaxStartupsIPs{$IP}++; } elsif (($hr, $min, $sec, $conn) = ($ThisLine =~ /exited MaxStartups throttling after (\d\d):(\d\d):(\d\d), (\d+) connections dropped/)) { $MaxStartupsTime += (((($hr * 60) + $min) * 60) + $sec); $MaxStartupsDrops += $conn; } else { # Report any unmatched entries... unless ($ThisLine =~ /fwd X11 connect/) { $OtherList{$ThisLine} += 1; } } } ########################################################### sub timesplural { my ($count) = @_; my $plural = ($count > 1) ? "s" : ""; return "$count Time$plural\n"; } if ($NetworkErrors) { print "\nNetwork Read Write Errors: " . $NetworkErrors . "\n"; } if ($Kills) { print "\nSSHD Killed: " . timesplural($Kills); } if ($Starts) { print "\nSSHD Started: " . timesplural($Starts); } if (keys %DeprecatedOption) { print "\nDeprecated options in SSH config:\n"; foreach my $Option (sort {$a cmp $b} keys %DeprecatedOption) { print " $Option\n"; } } if (keys %RootLogin) { print "\n\nWARNING!!!\n"; print "Refused ROOT login attempt from:\n"; foreach my $Host (sort {$a cmp $b} keys %RootLogin) { print " $Host : " . timesplural($RootLogin{$Host}); } } if (keys %BindFailed) { print "\nFailed to bind:\n"; foreach my $ThisOne (sort {$a cmp $b} keys %BindFailed) { print " $ThisOne : " . timesplural($BindFailed{$ThisOne}); } } if ($Detail >= 30 && keys %ConnectFailed) { # SSH Socks Forwarding print "\nFailed to connect to:\n"; foreach my $ThisOne (sort {$a cmp $b} keys %ConnectFailed) { print " $ThisOne : " . timesplural($ConnectFailed{$ThisOne}); } } if ($Detail >= 10) { if (keys %NoRevMap) { print "\nCouldn't resolve these IPs:\n"; foreach my $ThisOne (sort {$a cmp $b} keys %NoRevMap) { print " $ThisOne: " . timesplural($NoRevMap{$ThisOne}); } } if (keys %NoIdent) { print "\nDidn't receive an ident from these IPs:\n"; foreach my $ThisOne (sort {$a cmp $b} keys %NoIdent) { print " $ThisOne: " . timesplural($NoIdent{$ThisOne}); } } if (keys %MisMatch) { print "\nMismatched host names and/or IPs:\n"; foreach my $ThisOne (sort keys %MisMatch) { print " $ThisOne: " . timesplural($MisMatch{$ThisOne}); } } } if (keys %NegotiationFailed) { print "\nNegotiation failed:\n"; foreach my $Reason (sort {$a cmp $b} keys %NegotiationFailed) { my $Total = 0; print " $Reason"; if ( $Detail > 0 ) { print "\n"; } foreach my $Host (sort {$a cmp $b} keys %{$NegotiationFailed{$Reason}}) { my $HostTotal = 0; foreach my $Offer (sort {$a cmp $b} keys %{$NegotiationFailed{$Reason}{$Host}}) { $HostTotal += $NegotiationFailed{$Reason}{$Host}{$Offer}; } $Total += $HostTotal; if ( $Detail > 0 ) { print " $Host: " . timesplural($HostTotal); } if ( $Detail > 5 ) { foreach my $Offer (sort {$a cmp $b} keys %{$NegotiationFailed{$Reason}{$Host}}) { my $tot = $NegotiationFailed{$Reason}{$Host}{$Offer}; print " $Offer: " . timesplural($tot); } } } if ( $Detail == 0 ) { print ": " . timesplural($Total); } } } if ($NoCipher && $Detail > 0) { print "\nNo matching cipher offered: " . timesplural($NoCipher); } if (keys %TooManyFailures) { print "\nDisconnecting after too many authentication failures for user:\n"; foreach my $User (sort {$a cmp $b} keys %TooManyFailures) { print " $User : " . timesplural($TooManyFailures{$User}); } } if (keys %BadLogins) { print "\nFailed logins from:\n"; foreach my $ip (sort SortIP keys %BadLogins) { my $name = LookupIP($ip); my $totcount = 0; foreach my $user (keys %{$BadLogins{$ip}}) { $totcount += $BadLogins{$ip}{$user}; } print " $name: ". timesplural($totcount); if ($Detail >= 5) { my $sort = CountOrder(%{$BadLogins{$ip}}); foreach my $user (sort $sort keys %{$BadLogins{$ip}}) { my $val = $BadLogins{$ip}{$user}; print " $user: " . timesplural($val); } } } } if (keys %IllegalUsers) { print "\nIllegal users from"; if ($IllegalUsersThreshold) { print " (with threshold >= $IllegalUsersThreshold)"; } print ":\n"; foreach my $ip (sort SortIP keys %IllegalUsers) { my $name = LookupIP($ip); my $totcount = 0; foreach my $user (keys %{$IllegalUsers{$ip}}) { $totcount += $IllegalUsers{$ip}{$user}; } if ($IllegalUsersThreshold == 0 || $totcount >= $IllegalUsersThreshold) { print " $name: " . timesplural($totcount); if ($Detail >= 5) { my $sort = CountOrder(%{$IllegalUsers{$ip}}); foreach my $user (sort $sort keys %{$IllegalUsers{$ip}}) { my $val = $IllegalUsers{$ip}{$user}; print " $user: " . timesplural($val); } } } } } if (keys %LockedAccount) { print "\nLocked account login attempts:\n"; foreach my $User (sort {$a cmp $b} keys %LockedAccount) { print " $User : " . timesplural($LockedAccount{$User}); } } if (keys %AllowUsers) { print "\nLogin attempted when not in AllowUsers list:\n"; foreach my $User (sort {$a cmp $b} keys %AllowUsers) { print " $User : " . timesplural($AllowUsers{$User}); } } if (keys %DenyUsers) { print "\nLogin attempted when in DenyUsers list:\n"; foreach my $User (sort {$a cmp $b} keys %DenyUsers) { print " $User : . " . timesplural($DenyUsers{$User}); } } if (keys %AllowGroups) { print "\nLogin attempted when not in AllowGroups list:\n"; foreach my $User (sort {$a cmp $b} keys %AllowGroups) { print " $User : " . timesplural($AllowGroups{$User}); } } if (keys %DenyGroups) { print "\nLogin attempted when in DenyGroups list:\n"; foreach my $User (sort {$a cmp $b} keys %DenyGroups) { print " $User : " . timesplural($DenyGroups{$User}); } } if (keys %PamDeny) { print "\nLogin attempted when denied by PAM configuration:\n"; foreach my $User (sort {$a cmp $b} keys %PamDeny) { print " $User : " . timesplural($PamDeny{$User}); } } if (keys %NoGroups) { print "\nLogin attempted when user is in no group:\n"; foreach my $User (sort {$a cmp $b} keys %NoGroups) { print " $User : " . timesplural($NoGroups{$User}); } } if (keys %NoShellUsers) { print "\nLogin attempted when shell does not exist:\n"; foreach my $User (sort {$a cmp $b} keys %NoShellUsers) { print " $User : " . timesplural($NoShellUsers{$User}); } } if (keys %ShellNotExecutableUsers) { print "\nLogin attempted when shell is not executable:\n"; foreach my $User (sort {$a cmp $b} keys %ShellNotExecutableUsers) { print " $User : " . timesplural($ShellNotExecutableUsers{$User}); } } if ((keys %LoginLock) and ($Detail >= 5)) { print "\nUser login attempt when nologin was set:\n"; foreach my $User (sort {$a cmp $b} keys %LoginLock) { print " $User : " . timesplural($LoginLock{$User}); } } if (keys %PostPonedAuth) { print "\nPostponed authentication:\n"; foreach my $User (sort {$a cmp $b} keys %PostPonedAuth) { print " $User:\n"; foreach my $Host (sort {$a cmp $b} keys %{$PostPonedAuth{$User}}) { print " $Host: " . timesplural($PostPonedAuth{$User}{$Host}); } } } if (keys %Users) { print "\nUsers logging in through sshd:\n"; foreach my $user (sort {$a cmp $b} keys %Users) { print " $user:\n"; if ($Detail < 20) { my $totalSort = TotalCountOrder(%{$Users{$user}}, \&SortIP); foreach my $ip (sort $totalSort keys %{$Users{$user}}) { my $name = LookupIP($ip); my $val = (values %{$Users{$user}{$ip}})[0]; print " $name: " . timesplural($val); } } else { my %Methods = (); foreach my $ip (keys %{$Users{$user}}) { foreach my $method (keys %{$Users{$user}{$ip}}) { $Methods{$method}{$ip} = $Users{$user}{$ip}{$method}; } } if (scalar keys %{$Users{$user}} < scalar %Methods) { my $totalSort = TotalCountOrder(%{$Users{$user}}, \&SortIP); foreach my $ip (sort $totalSort keys %{$Users{$user}}) { my $name = LookupIP($ip); print " $name:\n"; my $sort = CountOrder(%{$Users{$user}{$ip}}); foreach my $method (sort $sort keys %{$Users{$user}{$ip}}) { my $val = $Users{$user}{$ip}{$method}; print " $method: " . timesplural($val); } } } else { my $totalSort = TotalCountOrder(%Methods); foreach my $method (sort $totalSort keys %Methods) { print " $method:\n"; my $sort = CountOrder(%{$Methods{$method}}); foreach my $ip (sort $sort keys %{$Methods{$method}}) { my $name = LookupIP($ip); my $val = (values %{$Users{$user}{$ip}})[0]; print " $name: " . timesplural($val); } } } } } } if (keys %RefusedAuthentication) { print "\nAuthentication refused:\n"; foreach my $Reason (sort {$a cmp $b} keys %RefusedAuthentication) { print " $Reason : " . timesplural($RefusedAuthentication{$Reason}); } } if (keys %KrbAutFail) { print "\n Failed pam_krb5 authentication:\n"; foreach my $User (sort keys %KrbAutFail) { print " $User: " . timesplural($KrbAutFail{$User}); } } if (keys %KrbAutErr) { print "\n pam_krb5 authentication errors:\n"; foreach my $Error (sort keys %KrbAutErr) { print " $Error: " . timesplural($KrbAutErr{$Error}); } } if (keys %KrbErr) { print "\n pam_krb5 errors:\n"; foreach my $Error (sort keys %KrbErr) { print " $Error: " . timesplural($KrbErr{$Error}); } } if (keys %DisconnectReceived) { print "\nReceived disconnect:\n"; foreach my $Reason (sort {$a cmp $b} keys %DisconnectReceived) { my $Total = 0; print " $Reason"; foreach my $Host (sort {$a cmp $b} keys %{$DisconnectReceived{$Reason}}) { $Total += $DisconnectReceived{$Reason}{$Host}; if( $Detail > 0 ) { print "\n $Host : $DisconnectReceived{$Reason}{$Host} Time(s)"; } } if( $Detail > 0 ) { print "\n"; } else { print " : " . timesplural($Total); } } } if ($#Scanned >= 0) { print "\nScanned from:\n"; foreach my $ThisOne (sort SortIP @Scanned) { print " " . LookupIP($ThisOne) . "\n"; } } if (keys %RefusedConnections) { my $output; foreach my $badguy (sort {$a cmp $b} keys %RefusedConnections ) { if ($RefusedConnectionsThreshold == 0 || $Detail > 5 || $RefusedConnections{$badguy} >= $RefusedConnectionsThreshold) { $output .= " $badguy: " . timesplural($RefusedConnections{$badguy}); } } if ($output ne '') { print "\nRefused incoming connections:\n"; print $output; } } if ($MaxStartupsThrottling) { print "\nMaxStartups throttling begins: " . timesplural($MaxStartupsThrottling); if ($Detail >= 5) { print " Dropped connections total: " . timesplural($MaxStartupsDrops); my $hr = $MaxStartupsTime / 3600; my $min = ($MaxStartupsTime / 60) % 60; my $sec = $MaxStartupsTime % 60; printf " Throttling time total: %02d:%02d:%02d\n", $hr, $min, $sec; } if ($Detail >= 10) { print " Initial dropped IP:\n"; foreach my $ThisOne (sort SortIP keys %MaxStartupsIPs) { print " " . LookupIP($ThisOne) . " : " . timesplural($MaxStartupsIPs{$ThisOne}); } } } if (keys %PamReleaseFail) { print "\nCannot release PAM authentication:\n"; foreach my $Error (sort {$a cmp $b} keys %PamReleaseFail) { print " $Error : " . timesplural($PamReleaseFail{$Error}); } } if (keys %ShadowInfo) { print "\nCould not get shadow information for:\n"; foreach my $Error (sort {$a cmp $b} keys %ShadowInfo) { print " $Error : " . timesplural($ShadowInfo{$Error}); } } if (keys %PamError) { print "\nError in PAM authentication:\n"; foreach my $Error (sort {$a cmp $b} keys %PamError) { print " $Error : " . timesplural($PamError{$Error}); } } if (keys %PamChroot) { print "\nPAM chroot:\n"; foreach my $Reason (sort {$a cmp $b} keys %PamChroot) { print " $Reason : " . timesplural($PamChroot{$Reason}); } } if (keys %TTYModesFail) { print "\nSetting tty modes failed:\n"; foreach my $Reason (sort {$a cmp $b} keys %TTYModesFail) { print " $Reason : " . timesplural($TTYModesFail{$Reason}); } } if ($sftpRequests > 0) { print "\nSFTP subsystem requests: $sftpRequests Time(s)\n"; if ($Detail >= 50) { foreach my $root (sort {$a cmp $b} keys %Chroot) { print " Chroot: $root : " . timesplural($Chroot{$root}); } } if ($Detail >= 0) { foreach my $dir (sort {$a cmp $b} keys %CloseDir) { if ($CloseDir{$dir} != $OpenDir{$dir} || $Detail >= 40) { print " Directory $dir: opened/closed $OpenDir{$dir}/$CloseDir{$dir} Time(s)\n"; # Note: this number might not match if the open/closes span log windows..." } } } if ($Detail >= 30) { foreach my $details (sort {$a cmp $b} keys %CloseFileReadWrite) { if (my ($file,$read,$written) = ($details =~ /^(.*),(\d+),(\d+)$/)) { if ($read || $written || $Detail >= 40) { print " Read/Wrote $read/$written byte(s) from file $file\n"; } } } } if ($Detail >= 60) { foreach my $details (sort {$a cmp $b} keys %OpenFile) { if (my ($file,$flags,$mode) = ($details =~ /^(.*):([^:]*):(\d+)$/)) { print " Opened (mode: $mode, flags: $flags) file $file\n"; } } } if ($Detail >= 70) { foreach my $path (sort {$a cmp $b} keys %RealPath) { print " Realpath $path\n"; } } if ($Detail >= 50) { foreach my $details (sort {$a cmp $b} keys %SetModtime) { if (my ($modtime,$file) = ($details =~ /^([^,]*),(.*)$/)) { print " Set modtime $modtime for file $file\n"; } } } if ($Detail >= 70) { foreach my $path (sort {$a cmp $b} keys %Stat) { print " Stat: $path : " . timesplural($Stat{$path}); } } if ($Detail >= 40) { if ($StatusNoSuchFile) { print " Sent status No such file: " . timesplural($StatusNoSuchFile); } } if ($Detail >= 0) { if ($BytesSent || $BytesReceived) { print " Transferred: sent/received $BytesSent/$BytesReceived byte(s)\n"; } } if ($Detail >= 50) { foreach my $client (sort {$a cmp $b} keys %ClientVers) { print " Client version $client connected " . timesplural($ClientVers{$client}); } } } if (keys %ChmodErr) { print "\nChmod errors:\n"; foreach (sort keys %ChmodErr) { my ($File,$Perm,$Why)= split ","; print " " . $File . " " . $Perm . " failed(" . $Why . "): " . timesplural($ChmodErr{"$File,$Perm,$Why"}); } } if (keys %ChownErr) { print "\nChown errors:\n"; foreach (keys %ChownErr) { my ($File,$From,$To,$Why)= split ","; print " " . $File . " " . $From . " " .$To . " failed(" . $Why . "): " . timesplural($ChmodErr{"$File,$From,$To,$Why"}); } } if ( ($Detail == 7 && keys %Krb_realm > 1) || ($Detail > 7 && keys %Krb_realm) ){ print "\nSuccessful Kerberos Authentication from ",(scalar keys %Krb_realm)," realm:\n"; foreach my $realm (sort keys %Krb_realm) { if($Detail > 9){ print " ",$realm,":\n"; foreach my $user(sort keys %{$Krb_realm{$realm}}) { print " ",$user,": " . timesplural($Krb_realm{$realm}{$user}); } } else { print " ",$realm,": ". (scalar keys %{$Krb_realm{$realm}}) . " User(s)\n"; } } } if (keys %OtherList) { print "\n**Unmatched Entries**\n"; print "$_ : " . timesplural($OtherList{$_}) foreach sort keys %OtherList; } exit(0); # vi: shiftwidth=3 tabstop=3 syntax=perl et # Local Variables: # mode: perl # perl-indent-level: 3 # indent-tabs-mode: nil # End: