Hi,
I really appreciate the daily mails you get from the system. One thing that bothers me is the output included from the sshd service in the daily security output mail. There are always plenty of lines like
which is neither too interesting nor very helpful since this is just background noise. Today I had 64 lines like the ones quoted. You always have to scroll very much and the long list distracts from the other security messages. So, is there a way to achieve an output like
a summary of failed logins? I can always look myself at /var/log/auth.log if I'm really interested. That would me more helpful than listing all the dictionary attacks in the email.
I'd prefer not to disable the sshd security information completely but a more terse output would be nice.
Frank
I really appreciate the daily mails you get from the system. One thing that bothers me is the output included from the sshd service in the daily security output mail. There are always plenty of lines like
Code:
...
Jun 21 15:54:21 frodo sshd[86804]: Invalid user u44628 from 205.251.131.180
Jun 21 15:54:23 frodo sshd[86808]: Invalid user coferus from 205.251.131.180
Jun 21 15:54:47 frodo sshd[86857]: Invalid user allsystems from 205.251.131.180
Jun 21 15:54:53 frodo sshd[86869]: Invalid user dolphy from 205.251.131.180
...
Code:
Jun 21: 64 invalid user login attempts
Jun 21: 3 failed logins
I'd prefer not to disable the sshd security information completely but a more terse output would be nice.
Frank