sshguard-users

[Sshguard-users] possible bug

[Rob S. <sny...@gm...>]

using all the standard ubuntu 8.04 stuff

i started with the syslog approach. it didnt work. then for simplicity I
tried the tail method and get the following:
snyderra@rewop:~$ tail -n0 -F /var/log/auth.log |  /usr/sbin/sshguard
/usr/sbin/sshguard: line 1: syntax error near unexpected token `('
/usr/sbin/sshguard: line 1: `Jul  3 14:32:43 rewop sshd[7376]:
pam_unix(sshd:session): session closed for user snyderra'

here is a tail of /var/log/auth.log

Jul  3 14:47:35 rewop sudo: pam_unix(sudo:session): session opened for user
root by snyderra(uid=0)
Jul  3 14:47:35 rewop sudo: pam_unix(sudo:session): session closed for user
root
Jul  3 14:48:00 rewop sshd[8127]: Invalid user bob from 111.111.111.111
Jul  3 14:48:41 rewop sudo: snyderra : TTY=pts/0 ; PWD=/home/snyderra ;
USER=root ; COMMAND=/usr/bin/nano /etc/syslog.conf
Jul  3 14:48:41 rewop sudo: pam_unix(sudo:session): session opened for user
root by snyderra(uid=0)
Jul  3 14:48:41 rewop sudo: pam_unix(sudo:session): session closed for user
root
Jul  3 14:53:40 rewop sudo: pam_smbpass(sudo:auth): unrecognized option
[missingok]
Jul  3 14:53:40 rewop sudo: snyderra : TTY=pts/1 ; PWD=/home/snyderra ;
USER=root ; COMMAND=/usr/bin/aptitude
Jul  3 14:53:40 rewop sudo: pam_unix(sudo:session): session opened for user
root by snyderra(uid=0)



any ideas? am i doing something wrong?


thanks.

Re: [Sshguard-users] possible bug

[Mij <mi...@bi...>]

Rob,

this behaviour is curious. Do you have iptables installed
debugging under version 1.0 is not trivial as in version 1.1:
you may want to try compiling v1.1beta4 (installing is not needed)
and then:

1) run it as
./sshguard -d

2) paste in its standard input the "Invalid user..." line

3) see what command is executed and derive why the shell returns that  
error



On Jul 3, 2008, at 21:07 , Rob Snyder wrote:

> using all the standard ubuntu 8.04 stuff
>
> i started with the syslog approach. it didnt work. then for  
> simplicity I tried the tail method and get the following:
> snyderra@rewop:~$ tail -n0 -F /var/log/auth.log |  /usr/sbin/ 
> sshguard /usr/sbin/sshguard: line 1: syntax error near unexpected  
> token `('
> /usr/sbin/sshguard: line 1: `Jul  3 14:32:43 rewop sshd[7376]:  
> pam_unix(sshd:session): session closed for user snyderra'
>
> here is a tail of /var/log/auth.log
>
> Jul  3 14:47:35 rewop sudo: pam_unix(sudo:session): session opened  
> for user root by snyderra(uid=0)
> Jul  3 14:47:35 rewop sudo: pam_unix(sudo:session): session closed  
> for user root
> Jul  3 14:48:00 rewop sshd[8127]: Invalid user bob from  
> 111.111.111.111
> Jul  3 14:48:41 rewop sudo: snyderra : TTY=pts/0 ; PWD=/home/ 
> snyderra ; USER=root ; COMMAND=/usr/bin/nano /etc/syslog.conf
> Jul  3 14:48:41 rewop sudo: pam_unix(sudo:session): session opened  
> for user root by snyderra(uid=0)
> Jul  3 14:48:41 rewop sudo: pam_unix(sudo:session): session closed  
> for user root
> Jul  3 14:53:40 rewop sudo: pam_smbpass(sudo:auth): unrecognized  
> option [missingok]
> Jul  3 14:53:40 rewop sudo: snyderra : TTY=pts/1 ; PWD=/home/ 
> snyderra ; USER=root ; COMMAND=/usr/bin/aptitude
> Jul  3 14:53:40 rewop sudo: pam_unix(sudo:session): session opened  
> for user root by snyderra(uid=0)
>
>
>
> any ideas? am i doing something wrong?
>
>
> thanks.
> -------------------------------------------------------------------------
> Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
> Studies have shown that voting for your favorite open source project,
> along with a healthy diet, reduces your potential for chronic lameness
> and boredom. Vote Now at http://www.sourceforge.net/community/cca08_______________________________________________
> Sshguard-users mailing list
> Ssh...@li...
> https://lists.sourceforge.net/lists/listinfo/sshguard-users