Robin Atwood wrote:
> I constantly get dictionary attacks which produce messages like:
>
> Mar 23 04:42:04 opal sshd[1337]: Invalid user albert from 58.248.10.212
> Mar 23 04:42:07 opal sshd[1345]: Invalid user alexander from 58.248.10.212
> Mar 23 04:42:10 opal sshd[1350]: Invalid user andrea from 58.248.10.212
> Mar 23 04:42:14 opal sshd[1355]: Invalid user anna from 58.248.10.212
>
> Denyhosts seems usually to ignore these. So I added a config parameter
>
> USERDEF_FAILED_ENTRY_REGEX=re.compile(r"""Invalid user (?P<user>.*) .*from
> (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""")
Wrong format, you should have read the instructions more carefully, use:
USERDEF_FAILED_ENTRY_REGEX=Invalid user (?P<user>.*) .*from
(::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
or even shorter:
USERDEF_FAILED_ENTRY_REGEX=Invalid user (?P<user>\S+) from
(::ffff:)?(?P<host>\S+)
I see you copied FAILED_ENTRY_REGEX2, perhaps there's a problem with
that one and it would be better to fix it, not just add a replacement.
--
René Berber
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Denyhosts-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/denyhosts-user
