Re: [Sshguard-users] [bug] sshguard vulnerable to log injection

[Mij <mi...@bi...>]

Hello Jochem,

what SSHGuard version are you using?


On Aug 2, 2009, at 22:06 , Jochem Oosterveen wrote:

> Hi there,
>
> I would like to submit a bug report.
>
> jochem@office:~$ ssh "test from 123.123.123.123"@melon.internex.nl
> Password:
> Password:
> Password:
> Permission denied (publickey,keyboard-interactive).
> jochem@office:~$
>
> Aug  2 21:57:59 melon sshd[11103]: Invalid user test from
> 123.123.123.123 from 217.149.194.146
> Aug  2 21:57:59 melon sshd[11103]: error: PAM: authentication error
> for illegal user test from 123.123.123.123 from office.aivd.net
> Aug  2 21:57:59 melon sshd[11103]: Failed keyboard-interactive/pam for
> invalid user test from 123.123.123.123 from 217.149.194.146 port 38367
> ssh2
> Aug  2 21:58:00 melon sshd[11103]: error: PAM: authentication error
> for illegal user test from 123.123.123.123 from office.aivd.net
> Aug  2 21:58:00 melon sshd[11103]: Failed keyboard-interactive/pam for
> invalid user test from 123.123.123.123 from 217.149.194.146 port 38367
> ssh2
> Aug  2 21:58:00 melon sshd[11103]: error: PAM: authentication error
> for illegal user test from 123.123.123.123 from office.aivd.net
> Aug  2 21:58:00 melon sshd[11103]: Failed keyboard-interactive/pam for
> invalid user test from 123.123.123.123 from 217.149.194.146 port 38367
> ssh2
> Aug  2 21:58:01 melon sshd[11108]: Invalid user test from
> 123.123.123.123 from 217.149.194.146
> Aug  2 21:58:01 melon sshguard[11056]: Blocking 123.123.123.123: 4
> failures over 8 seconds.
>
> melon# pfctl -t sshguard -T show
> No ALTQ support in kernel
> ALTQ related functions disabled
>  123.123.123.123
> melon#
>
> Obviously, sshguard is blocking the wrong IP.
>
> Kind regards,
> Jochem Oosterveen
>
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal Reports 2008  
> 30-Day
> trial. Simplify your report design, integration and deployment - and  
> focus on
> what you do best, core application coding. Discover what's new with
> Crystal Reports now.  http://p.sf.net/sfu/bobj-july
> _______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users