lfd on host: SSH login alert - doesn't work when using key

[Ilia]

Hello, guys!

I just noticed that when I login to the SSH server, using key authentication (not password), I don't get an email alerts?

This is a bug, right? When the same happens using password, emails are coming correctly!

Could you please fix it?

[Ilia]

Yes, figured this out!

Because: my log line also contains a fingerprint:
RSA 21:48:5b:aa:aa:00:30:b2:39:41:42:a1:a8:1a:41:30

Example of log line:

Code: Select all

Nov  2 13:32:51 host sshd[10238]: Accepted publickey for root from 23.249.6.55 port 41950 ssh2: RSA 21:48:5b:aa:aa:00:30:b2:39:41:42:a1:a8:1a:41:30

[Ilia]

Adding a dot to the end of regex works fine, example:

Code: Select all

^(\S+|\S+\s+\d+\s+\S+) (\S+ )?sshd\[\d+\]: Accepted (\S+) for (\S+) from (\S+) port \S+ \S+\s.*$

Please fix it upon next release.

[ForumAdmin]

This has been added in csf v7.57:
http://blog.configserver.com/