Re: [Sshguard-users] OS X 10.10 (Yosemite) and "authentication error for <user> from <ip> via <ip>"

[Barry M. <bmu...@ga...>]

>
> found this (line 146) in "attack_scanner.l":


 /* wrong password for valid user @ FreeBSD, Debian */
"error: PAM: "[aA]"uthentication "(error|failure)" for "("illegal user
")?.+" from "            { return SSH_LOGINERR_PAM; }

which seems to be the appropriate pattern...
is there a quick way I can add to that pattern to keep it from spazzing out
when it gets the "via xx.xx.xx.xx"   ????