Page 1 of 1
lfd on host: SSH login alert - doesn't work when using key
Posted: 03 Nov 2014, 09:52
by Ilia
Hello, guys!
I just noticed that when I login to the SSH server, using key authentication (not password), I don't get an email alerts?
This is a bug, right? When the same happens using password, emails are coming correctly!
Could you please fix it?
Re: lfd on host: SSH login alert - doesn't work when using
Posted: 03 Nov 2014, 10:03
by Ilia
Yes, figured this out!
Because: my log line also contains a fingerprint:
RSA 21:48:5b:aa:aa:00:30:b2:39:41:42:a1:a8:1a:41:30
Example of log line:
Code: Select all
Nov 2 13:32:51 host sshd[10238]: Accepted publickey for root from 23.249.6.55 port 41950 ssh2: RSA 21:48:5b:aa:aa:00:30:b2:39:41:42:a1:a8:1a:41:30
Re: lfd on host: SSH login alert - doesn't work when using
Posted: 03 Nov 2014, 10:19
by Ilia
Adding a dot to the end of regex works fine, example:
Code: Select all
^(\S+|\S+\s+\d+\s+\S+) (\S+ )?sshd\[\d+\]: Accepted (\S+) for (\S+) from (\S+) port \S+ \S+\s.*$
Please fix it upon next release.
Re: lfd on host: SSH login alert - doesn't work when using
Posted: 01 Jan 2015, 09:38
by ForumAdmin
This has been added in csf v7.57:
http://blog.configserver.com/