From mboxrd@z Thu Jan  1 00:00:00 1970
From: git@ipfire.org
To: ipfire-scm@lists.ipfire.org
Subject: [git.ipfire.org] IPFire 2.x development tree branch, fifteen,
 updated. 2a747e37a86f44c5da8dbf67c4135772df29f24e
Date: Fri, 10 Jan 2014 16:20:24 +0100
Message-ID: <20140110152025.435D020AEC@argus.ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============0148084398913211285=="
List-Id: <ipfire-scm.lists.ipfire.org>

--===============0148084398913211285==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, fifteen has been updated
       via  2a747e37a86f44c5da8dbf67c4135772df29f24e (commit)
      from  7514fe47f6b2caf5a1dfc80de3a539975b753b21 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 2a747e37a86f44c5da8dbf67c4135772df29f24e
Author: Kim W=C3=B6lfel <xaver4all(a)gmx.de>
Date:   Fri Jan 10 16:19:43 2014 +0100

    guardian: React on BF attacks for SSH at pre-auth stage.
   =20
    See #10457.

-----------------------------------------------------------------------

Summary of changes:
 config/guardian/guardian.pl | 6 +++++-
 lfs/guardian                | 2 +-
 2 files changed, 6 insertions(+), 2 deletions(-)

Difference in files:
diff --git a/config/guardian/guardian.pl b/config/guardian/guardian.pl
index 86d93fe..34546b7 100644
--- a/config/guardian/guardian.pl
+++ b/config/guardian/guardian.pl
@@ -106,6 +106,10 @@ for (;;) {
 					$temp =3D $array[11];
 				}
 				&checkssh ($temp, "possible SSH-Bruteforce Attack");}
+
+			# This should catch Bruteforce Attacks with enabled preauth
+			if ($_ =3D~ /.*sshd.*Received disconnect from (\d{1,3}\.\d{1,3}\.\d{1,3}\=
.\d{1,3}):.*\[preauth\]/) {
+				&checkssh ($1, "possible SSH-Bruteforce Attack, failed preauth");}
 			}
 	}
=20
@@ -424,4 +428,4 @@ sub get_aliases {
 	}
=20
 	print "done \n";
-}
\ No newline at end of file
+}
diff --git a/lfs/guardian b/lfs/guardian
index fea50db..a91fbd9 100644
--- a/lfs/guardian
+++ b/lfs/guardian
@@ -30,7 +30,7 @@ THISAPP    =3D guardian-$(VER)
 DIR_APP    =3D $(DIR_SRC)/$(THISAPP)
 TARGET     =3D $(DIR_INFO)/$(THISAPP)
 PROG       =3D guardian
-PAK_VER    =3D 8
+PAK_VER    =3D 9
=20
 DEPS       =3D ""
=20


hooks/post-receive
--
IPFire 2.x development tree

--===============0148084398913211285==--