From 5e1d8b07e82eb7633d31bbb4bd446e753ff37128 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Tue, 7 May 2013 12:30:05 -0400 Subject: [PATCH] ENH: logs/sshd -- have ":" after [daemon] (other uses are uncommon) See https://github.com/fail2ban/fail2ban/issues/216\#issuecomment-17535577 for the analysis --- testcases/files/logs/sshd | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/testcases/files/logs/sshd b/testcases/files/logs/sshd index 3293126c..5dab1606 100644 --- a/testcases/files/logs/sshd +++ b/testcases/files/logs/sshd @@ -14,7 +14,8 @@ Jan 5 01:31:41 www sshd[1643]: ROOT LOGIN REFUSED FROM ::ffff:1.2.3.4 Jul 20 14:42:11 localhost sshd[22708]: Invalid user ftp from 211.114.51.213 #5 new filter introduced after looking at 44087D8C.9090407@bluewin.ch -Mar 3 00:17:22 [sshd] User root from 210.188.220.49 not allowed because not listed in AllowUsers +# yoh: added ':' after [sshd] since the case without is not really common any more +Mar 3 00:17:22 [sshd]: User root from 211.188.220.49 not allowed because not listed in AllowUsers Feb 25 14:34:11 belka sshd[31607]: User root from example.com not allowed because not listed in AllowUsers #6 ew filter introduced thanks to report Guido Bozzetto