search

acouvreur / ssh-log-to-influx

Send SSH authentication logs to influxdb with geohashing IP
GNU General Public License v3.0
101 stars 25 forks source link

Does not add line when user is in system but wrong public key/request #181

Open JensDeLeersnyder opened 2 years ago

JensDeLeersnyder commented 2 years ago

When someone tried to brute force and correcty gueses the username but wrong public key it isn't added to the database. This can maby be fixed by adding this code to the /etc/rsyslog.conf for public key. 

else if $msg startswith ' Connection reset by authenticating' then {
      action(type="omfwd" target="127.0.0.1" port="7070" protocol="tcp" template="OnlyMsg")
   }

I couldn't quite make up if this was suppored by the acouvreur/ssh-log-to-influx container.