Re: [Sshguard-users] "Connection closed by x.x.x.x [preauth]" attack not handled

[<jo...@te...>]

On Wed, 7 May 2014 18:25:08 +0200,
Anders Bergh <an...@gm...> wrote :

> I have thousands of lines like this in my auth.log:
> 
> May  7 08:28:26 vm sshd[15657]: Connection closed by 83.191.86.213
> [preauth]
> 
> sshguard 1.5.0 (Debian wheezy) doesn't seem to do anything about this.
> Should it?

sshguard will recognize 'May  7 08:28:26 vm sshd[15657]:'  This means
you can launch sshguard in debug mode and copy/paste the rest of the
log msg to see what the behaviour is.  Debug mode:

env SSHGUARD_DEBUG=foo <your path to sshguard>