Thanks for your reply.
René Berber <[EMAIL PROTECTED]> hat geschrieben: > > I don't see the same problem, in fact the IP appears only once in > /etc/hosts.deny and 71 times in > /usr/share/denyhosts/data/sync-received; so the > IP is being reported but denyhosts doesn't duplicate entries. > > What could be wrong? You don't give detailed information so the > following are > _only_guesses_: > > - The log file it is watching is in a non-standard format (no time-stamps > perhaps?) or corrupted. The auth.log should be in a standard-format (it has timestamps) Ex.: Jul 6 15:43:40 everest sshd[2642]: PAM: Authentication failure for root from mail.cars.com.ve Jul 6 15:43:43 everest sshd[2642]: PAM: Authentication failure for root from mail.cars.com.ve Jul 6 15:43:44 everest sshd: (pam_unix) 1 more authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.cars.com.ve user=root (This is from auth.log.0, in auth.log mail.cars.com.ve doesn't appear) > - You have a corrupted hosts.deny and somehow denyhosts doesn't see that the > entry is already there. ALL: mail.cars.com.ve ALL: mail.cars.com.ve ALL: mail.cars.com.ve ALL: mail.cars.com.ve ALL: mail.cars.com.ve ALL: 211.155.225.215 ALL: mail.cars.com.ve ALL: mail.cars.com.ve Seems to be not corrupted imho.. > - You have a corrupted denyhosts (what version are you using?) and it's not > working (you don't say if it catches other attempts for instance). I had v1.4 and then the problem appeared.. Then I changed from 1.4 to the actual version 2.5 and the problem appears, too. Has someone changed in saving denied hosts? (e.g. i don't have your sync-received..) My workdir: allowed-hosts hosts-root offset users-invalid hosts hosts-valid users-hosts users-valid > > Do you have anything interesting in the denyhosts log? Not really (I think): 2006-07-11 09:17:05,104 - denyhosts : INFO new denied hosts: ['mail.cars.com.ve '] 2006-07-11 09:18:05,173 - denyhosts : INFO new denied hosts: ['mail.cars.com.ve '] 2006-07-11 09:19:35,244 - denyhosts : INFO new denied hosts: ['mail.cars.com.ve '] 2006-07-11 09:20:05,338 - denyhosts : INFO new denied hosts: ['mail.cars.com.ve '] 2006-07-11 09:21:35,424 - denyhosts : INFO new denied hosts: ['mail.cars.com.ve '] 2006-07-11 09:22:05,494 - denyhosts : INFO new denied hosts: ['mail.cars.com.ve '] 2006-07-11 10:29:43,418 - denyhosts : INFO setting debug level to: DEBUG 2006-07-11 10:30:13,416 - denyhosts : DEBUG /var/log/auth.log has additional data 2006-07-11 10:30:13,452 - loginattempt: DEBUG suspicious-logins does not exist 2006-07-11 10:30:13,494 - denyhosts : DEBUG new hosts: [] 2006-07-11 10:30:13,494 - denyhosts : DEBUG no new denied hosts 2006-07-11 10:30:13,495 - denyhosts : DEBUG no new suspicious logins 2006-07-11 10:31:13,496 - denyhosts : DEBUG /var/log/auth.log has additional data 2006-07-11 10:31:13,533 - loginattempt: DEBUG suspicious-logins does not exist 2006-07-11 10:31:13,552 - denyhosts : DEBUG user: ircd - host: 212.60.36.226 - success: 1 - invalid: 0 2006-07-11 10:31:13,552 - denyhosts : DEBUG user: ircd - host: 212.60.36.226 - success: 1 - invalid: 0 2006-07-11 10:31:13,575 - denyhosts : DEBUG new hosts: [] 2006-07-11 10:31:13,576 - denyhosts : DEBUG no new denied hosts 2006-07-11 10:31:13,576 - denyhosts : DEBUG no new suspicious logins 2006-07-11 10:34:13,576 - denyhosts : DEBUG /var/log/auth.log has additional data 2006-07-11 10:34:13,613 - loginattempt: DEBUG suspicious-logins does not exist 2006-07-11 10:34:13,631 - denyhosts : DEBUG user: ircd - host: 212.60.36.226 - success: 1 - invalid: 0 2006-07-11 10:34:13,632 - denyhosts : DEBUG user: ircd - host: 212.60.36.226 - success: 1 - invalid: 0 2006-07-11 10:34:13,655 - denyhosts : DEBUG new hosts: [] 2006-07-11 10:34:13,655 - denyhosts : DEBUG no new denied hosts 2006-07-11 10:34:13,656 - denyhosts : DEBUG no new suspicious logins 2006-07-11 10:35:13,656 - denyhosts : DEBUG /var/log/auth.log has additional data 2006-07-11 10:35:13,693 - loginattempt: DEBUG suspicious-logins does not exist 2006-07-11 10:35:13,735 - denyhosts : DEBUG new hosts: [] 2006-07-11 10:35:13,735 - denyhosts : DEBUG no new denied hosts 2006-07-11 10:35:13,735 - denyhosts : DEBUG no new suspicious logins 2006-07-11 10:39:13,736 - denyhosts : DEBUG /var/log/auth.log has additional data 2006-07-11 10:39:13,772 - loginattempt: DEBUG suspicious-logins does not exist 2006-07-11 10:39:13,814 - denyhosts : DEBUG new hosts: [] 2006-07-11 10:39:13,815 - denyhosts : DEBUG no new denied hosts 2006-07-11 10:39:13,815 - denyhosts : DEBUG no new suspicious logins 2006-07-11 10:40:13,816 - denyhosts : DEBUG /var/log/auth.log has additional data 2006-07-11 10:40:13,852 - loginattempt: DEBUG suspicious-logins does not exist 2006-07-11 10:40:13,894 - denyhosts : DEBUG new hosts: [] 2006-07-11 10:40:13,894 - denyhosts : DEBUG no new denied hosts 2006-07-11 10:40:13,895 - denyhosts : DEBUG no new suspicious logins After i saw that suspicious-logins doesn't exist, I touched it in the workdir.. > > Have you ran the program in debug mode? I'm currently in debug mode after you said that ;) -Michael -- Administrator Chat-Net Projektleitung und Administration mailto:[EMAIL PROTECTED] http://www.chat-net.ch ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Denyhosts-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/denyhosts-user
