daniell/parserfilter
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Compare commits

base: daniell:c4ef60e38f23fbbaebe55b26f38bfc337cc453e8
Branches Tags
daniell:master
...
compare: daniell:68ab6d0437f59459284678b5bdd6e0dcfc80a339
Branches Tags
daniell:master

2 Commits
c4ef60e38f ... 68ab6d0437

Author SHA1 Message Date
Daniel Lysfjord
68ab6d0437 Add support for new(?) Authentication error messages from PAM. 2024-03-24 13:35:48 +01:00
Daniel Lysfjord
b672e4274d Add broken pipe to banner exchange errors 2024-03-24 13:31:47 +01:00
1 changed files with 9 additions and 1 deletions
Expand all files Collapse all files

10
lib/ssh_parser.pm
View File

@ -161,7 +161,7 @@ sub parser {
m/ ($re_host) /gcix && do {
$host = $1;
};
} elsif($string =~ m/banner exchange: Connection from $re_host port [0-9]{1,6}: (invalid format|Permission denied|could not read protocol version)/) {
} elsif($string =~ m/banner exchange: Connection from $re_host port [0-9]{1,6}: (invalid format|Permission denied|could not read protocol version|Broken pipe)/) {
$_ = $string;
$hostile = 1;
$reply = 'Error during banner exchange';
@ -169,6 +169,14 @@ sub parser {
m/ ($re_host) /gcix && do {
$host = $1;
};
} elsif($string =~ m/Authentication error for( illegal user|) $re_user from $re_host/) {
$_ = $string;
$hostile = 1;
$reply = 'Authentication error';
PARSER:
m/from\ ($re_host)$/gcix && do {
$host = $1;
};
} else {
$reply = 'No match for '.$string;
}