diff options
| author | Jonas Smedegaard <dr@jones.dk> | 2005-08-06 10:14:24 +0000 |
|---|---|---|
| committer | Jonas Smedegaard <dr@jones.dk> | 2005-08-06 10:14:24 +0000 |
| commit | 854ebe278dcdef4f7164173f6388b9fcf3d2abf8 (patch) | |
| tree | 0d23410cad45dc53be9936602b7d2d21d69369ae /logcheck/ignore.d.server | |
| parent | e4f125330b261f4c76770c735482df5ce794a9c6 (diff) | |
Illegal SSHv1 connections does not emit port number, it seems.
Diffstat (limited to 'logcheck/ignore.d.server')
| -rw-r--r-- | logcheck/ignore.d.server/ssh | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/logcheck/ignore.d.server/ssh b/logcheck/ignore.d.server/ssh index 56e072a..bf1cf50 100644 --- a/logcheck/ignore.d.server/ssh +++ b/logcheck/ignore.d.server/ssh @@ -11,4 +11,4 @@ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: subsystem request for sftp$ # Cracking attempts are too common, so clutters more than it helps to warn about them -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: (Failed password from illegal|Illegal) user [[:alnum:]]+ from [\.0-9]+ port [0-9]+( ssh2)?$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: (Failed password from illegal|Illegal) user [[:alnum:]]+ from [\.0-9]+( port [0-9]+ ssh2)?$ |