RFC: Improve address logging on early exit messages

[ldir-EDB0]

Change 'Early exit' and 'Exit before auth' messages to include the IP
address & port as part of the message.

This allows log scanning utilities such as 'fail2ban' to obtain the
offending IP address as part of the failure event instead of extracting
the PID from the message and then scanning the log again for match
'child connection from' messages

Signed-off-by: Kevin Darbyshire-Bryant ldir@darbyshire-bryant.me.uk

Delimiting with < > may be a step too far... or the whole idea... hence the RFC :-)

[mkj]

I like this. I'll merge it once I give it a try. Thanks

…

On 16 October 2019 5:48:21 pm AWST, Kevin Darbyshire-Bryant ***@***.***> wrote: Change &#39;Early exit&#39; and &#39;Exit before auth&#39; messages to include the IP address &amp; port as part of the message. This allows log scanning utilities such as &#39;fail2ban&#39; to obtain the offending IP address as part of the failure event instead of extracting the PID from the message and then scanning the log again for match &#39;child connection from&#39; messages Signed-off-by: Kevin Darbyshire-Bryant ***@***.***&gt; Delimiting with &lt; &gt; may be a step too far... or the whole idea... hence the RFC :-) You can view, comment on, or merge this pull request online at: #83 -- Commit Summary -- * Improve address logging on early exit messages -- File Changes -- M svr-auth.c (18) M svr-session.c (8) -- Patch Links -- https://github.com/mkj/dropbear/pull/83.patch https://github.com/mkj/dropbear/pull/83.diff -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: #83

[ldir-EDB0]

Friendly ping

[ldir-EDB0]

Ping

[mkj]

Thanks

[mkj]

I've changed the format slightly in 201e359. It wasn't handling some cases where addrstring hadn't been set yet.

[MichaIng]

When doing changes which are intended to help software like Fail2Ban, while containing breaking changes for them, it makes sense to communicate it, or send a commit with the needed filter changes. The Fail2Ban Dropbear filter was now partly broken for several years 😉: fail2ban/fail2ban#3791

Another issue: "Login attempt for nonexistent user" is no early exit message, hence those do now not contain a host anymore and are impossible to track with this change. I can send a PR to revert this part of the code, if wanted. I think it is important.

EDIT: I guess the same is true for "Login attempt with wrong user", but I cannot test it quickly now.

EDIT2: Too important to communicate through a closed PR, hence here the partial revert: #316