René Berber napsal(a): > And after that? The next line in the log should be the real break-in > attempt, with a user name and password. > > I might forgot to mention that the log is auth.log. The next doesnt contain any user name and pasword:
Mar 30 11:24:21 localhost sshd[17762]: Address 201.236.88.219 maps to webserver.ingenieriaambiental.cl, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT! Mar 30 11:24:22 localhost sshd[17764]: Address 201.236.88.219 maps to webserver.ingenieriaambiental.cl, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT! Mar 30 11:24:31 localhost sshd[17766]: Address 201.236.88.219 maps to webserver.ingenieriaambiental.cl, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT! Mar 30 11:24:32 localhost sshd[17769]: Address 201.236.88.219 maps to webserver.ingenieriaambiental.cl, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT! Mar 30 11:24:40 localhost sshd[17771]: Address 201.236.88.219 maps to webserver.ingenieriaambiental.cl, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT! Mar 30 11:24:46 localhost sshd[17773]: Address 201.236.88.219 maps to webserver.ingenieriaambiental.cl, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT! Mar 30 11:24:56 localhost sshd[17776]: Address 201.236.88.219 maps to webserver.ingenieriaambiental.cl, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT! Mar 30 11:24:57 localhost sshd[17778]: Address 201.236.88.219 maps to webserver.ingenieriaambiental.cl, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT! > Oops! sorry, it should say: > > USERDEF_FAILED_ENTRY_REGEX=Address (?P<host>\S+) maps .* does not map .* First I try the hint from Peter Bance, cause I am not good enough in regex .... Thanks to all. -- geon Pavel Kosina ------------------------------------------------------------------------- Check out the new SourceForge.net Marketplace. It's the best place to buy or sell services for just about anything Open Source. http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace _______________________________________________ Denyhosts-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/denyhosts-user
