So on FC3 I keep getting the daily logwatch email, and it reports on
all the people trying to break into my sshd server, but looks like the
script:
m/^Failed (\S+) for illegal user (.*) from ([^ ]+) port (\d+)/ ) { #openssh
is wrong, it should be:
m/^Failed (\S+) for invalid user (.*) from ([^ ]+) port (\d+)/ ) {
similarly for other lines, such as User not allowed.
/etc/log.d/scripts/services/sshd
script is not right for FC3.
Does anyone else with FC3, and ssh enabled, have these problems?
Not sure if I should submit a bug report (I did send email to the
person listed in the logwatch script, but received no response).
