I'm running DenyHosts on OpenBSD 4.0, and noticed a couple of things. 1. It seems that PLUGIN_DENY is not run for synced hosts. 2. FAILED_ENTRY_REGEX5 seemes to need a minor tweak to work with current OpenSSH.
Attached is a patch. regards, crh
diff -ru DenyHosts-2.6/DenyHosts/deny_hosts.py
DenyHosts-2.6-patched/DenyHosts/deny_hosts.py
--- DenyHosts-2.6/DenyHosts/deny_hosts.py Thu Nov 9 22:25:38 2006
+++ DenyHosts-2.6-patched/DenyHosts/deny_hosts.py Sat Jan 20 13:21:30 2007
@@ -334,6 +334,10 @@
if fp != sys.stdout:
fp.close()
+ plugin_deny = self.__prefs.get('PLUGIN_DENY')
+ if plugin_deny:
+ plugin.execute(plugin_deny, new_hosts)
+
return new_hosts, status
@@ -437,8 +441,6 @@
msg = "Added the following hosts to %s" %
self.__prefs.get('HOSTS_DENY')
self.__report.add_section(msg, new_denied_hosts)
if self.__sync_server: self.sync_add_hosts(new_denied_hosts)
- plugin_deny = self.__prefs.get('PLUGIN_DENY')
- if plugin_deny: plugin.execute(plugin_deny, deny_hosts)
new_suspicious_logins = login_attempt.get_new_suspicious_logins()
if new_suspicious_logins:
diff -ru DenyHosts-2.6/DenyHosts/regex.py
DenyHosts-2.6-patched/DenyHosts/regex.py
--- DenyHosts-2.6/DenyHosts/regex.py Thu Dec 7 13:47:04 2006
+++ DenyHosts-2.6-patched/DenyHosts/regex.py Sat Jan 20 13:44:34 2007
@@ -17,7 +17,7 @@
FAILED_ENTRY_REGEX4 = re.compile(r"""Authentication failure for (?P<user>.*)
.*from (?P<host>.*)""")
-FAILED_ENTRY_REGEX5 = re.compile(r"""User (?P<user>.*) .*from (?P<host>.*) not
allowed because none of user's groups are listed in AllowGroups""")
+FAILED_ENTRY_REGEX5 = re.compile(r"""User (?P<user>.*) .*from (?P<host>.*) not
allowed because (none of user's groups are listed in AllowGroups|not listed in
AllowUsers)""")
FAILED_ENTRY_REGEX6 = re.compile(r"""Did not receive identification string
.*from (::ffff:)?(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})""")
pgpsYmSVlbKts.pgp
Description: PGP signature
------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________ Denyhosts-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/denyhosts-user
