7a301384b6
hostname regexp. Fix the regexp for hostname matching. - While fixing that, fix IPv6 regexp, too. - Reduce syslog level from ERROR to INFO for most informational messages. These changes are submitted to author for inclusion in next version. - Grab maintainership as current maintainer does not use it anymore. - Bump PORTREVISION. Approved by: portmgr (linimon), maintainer via irc
68 lines
2.7 KiB
Diff
68 lines
2.7 KiB
Diff
--- sshit.orig 2007-11-07 13:56:13.000000000 +0800
|
|
+++ sshit 2007-11-07 13:56:16.000000000 +0800
|
|
@@ -283,7 +283,7 @@
|
|
if ($list{$ip}{n} < $MAX_COUNT) {
|
|
# delete all ip's that hasn't reached $MAX_COUNT within time
|
|
if (time() - $list{$ip}{time} > $WITHIN_TIME) {
|
|
- syslog(LOG_ERR, "janitor deleted $ip (did not reach $MAX_COUNT attempts within $WITHIN_TIME seconds)\n");
|
|
+ syslog(LOG_INFO, "janitor deleted $ip (did not reach $MAX_COUNT attempts within $WITHIN_TIME seconds)\n");
|
|
delete($list{$ip});
|
|
}
|
|
} else {
|
|
@@ -297,7 +297,7 @@
|
|
} elsif ($FIREWALL_TYPE =~ /^pf$/i) {
|
|
system("$PFCTL_CMD -t $PF_TABLE -Tdelete $ip");
|
|
}
|
|
- syslog(LOG_ERR, "janitor removed block rule $list{$ip}{rulenr} for $ip (reset time of $RESET_IP seconds reached)\n");
|
|
+ syslog(LOG_INFO, "janitor removed block rule $list{$ip}{rulenr} for $ip (reset time of $RESET_IP seconds reached)\n");
|
|
delete($list{$ip});
|
|
}
|
|
}
|
|
@@ -317,7 +317,7 @@
|
|
|
|
while (<>) {
|
|
chomp;
|
|
- if (/(failed|Invalid user) .*from (\d+\.\d+\.\d+\.\d+|[\da-fA-F:]+)/i ) { # IPv4 & IPv6
|
|
+ if (/(failed|error|Invalid user) .*from (\d+\.\d+\.\d+\.\d+|[\da-f:]*:[\da-f:]+|([\da-z-]+\.)+[a-z]{2,4})/i ) { # IPv4 & IPv6
|
|
$ip = $2;
|
|
if ($list{$ip}{name}) {
|
|
if ($list{$ip}{n} >= $MAX_COUNT) {
|
|
@@ -339,17 +339,17 @@
|
|
# Assign a rule number and do the actual block
|
|
$list{$ip}{rulenr} = $ipfw_rulenr;
|
|
system("$IPFW_CMD add $ipfw_rulenr deny tcp from $ip to me 21,22 > /dev/null");
|
|
- syslog(LOG_ERR, "BLOCKING $ip, rule $ipfw_rulenr\n");
|
|
+ syslog(LOG_INFO, "BLOCKING $ip, rule $ipfw_rulenr\n");
|
|
$ipfw_rulenr++;
|
|
if ($ipfw_rulenr > $IPFW_RULE_END) { $ipfw_rulenr = $IPFW_RULE_START; }
|
|
|
|
} elsif ($FIREWALL_TYPE =~ /^ipfw2$/i) {
|
|
system("$IPFW2_CMD table $IPFW2_TABLE_NO add $ip");
|
|
- syslog(LOG_ERR, "BLOCKING $ip with ipfw2\n");
|
|
+ syslog(LOG_INFO, "BLOCKING $ip with ipfw2\n");
|
|
|
|
} elsif ($FIREWALL_TYPE =~ /^pf$/i) {
|
|
system("$PFCTL_CMD -t $PF_TABLE -Tadd $ip");
|
|
- syslog(LOG_ERR, "BLOCKING $ip with pf\n");
|
|
+ syslog(LOG_INFO, "BLOCKING $ip with pf\n");
|
|
}
|
|
}
|
|
}
|
|
@@ -364,7 +364,7 @@
|
|
}
|
|
}
|
|
|
|
-syslog(LOG_ERR, "fd closed. clean up");
|
|
+syslog(LOG_INFO, "fd closed. clean up");
|
|
foreach $ip (keys %list) {
|
|
if($FIREWALL_TYPE =~ /^ipfw$/i)
|
|
{
|
|
@@ -374,7 +374,7 @@
|
|
} elsif ($FIREWALL_TYPE =~ /^pf$/i) {
|
|
system("$PFCTL_CMD -t $PF_TABLE -Tdelete $ip");
|
|
}
|
|
- syslog(LOG_ERR, "main removed block rule $list{$ip}{rulenr} for $ip (reset time of $RESET_IP seconds reached)\n");
|
|
+ syslog(LOG_INFO, "main removed block rule $list{$ip}{rulenr} for $ip (reset time of $RESET_IP seconds reached)\n");
|
|
delete($list{$ip});
|
|
}
|
|
|