Changeset 888

Timestamp:

Nov 20, 2008, 12:38:26 AM (17 years ago)

Author:

geofft

Message:

Display failed root logins from off campus only at 10+10k attempts.

File:

• server/fedora/config/etc/syslog-ng/d_zroot.pl (modified) (2 diffs)

server/fedora/config/etc/syslog-ng/d_zroot.pl

@@ -67 +67 @@
     map { s/^(.*?): // } @message;
     %toclass = ();
+    my %ips = ();
     foreach my $message (@message) {
         sub sendmsg ($;$) {
@@ -86 +87 @@
             } else {
                 sendmsg($message." (UNKNOWN KEY)");
+            }
+        } elsif ($message =~ m|^Failed keyboard-interactive/pam for root from ([^ ]*)| {
+            my $count = ++$ips{$1};
+            if ($count % 10 == 0 or $1 =~ /^18\./) {
+                sendmsg($message." (repeated $count times)", "scripts-spew");
             }
         } elsif ($message =~ m|^Out of memory:|) {