From eb8b44370ae93794208de1c60220d45a57b44018 Mon Sep 17 00:00:00 2001 From: MichaIng Date: Thu, 11 Jul 2024 19:33:44 +0200 Subject: [PATCH] Make Dropbear regex more compatible and simpler Dropbear uses `strftime` `"%b %d %H:%M:%S` to print its timestamps, hence we know the day and time format, but the month could be localized. We hence allow any 3 word characters for it, and additionally simplify the day and time pattern into a single group. Signed-off-by: MichaIng --- config/filter.d/dropbear.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/dropbear.conf b/config/filter.d/dropbear.conf index 3523be42..b5329555 100644 --- a/config/filter.d/dropbear.conf +++ b/config/filter.d/dropbear.conf @@ -23,7 +23,7 @@ before = common.conf _daemon = dropbear -prefregex = ^%(__prefix_line)s(\[\d+\] [A-Z][a-z]+ \d\d \d\d:\d\d:\d\d )?(?:[Ll]ogin|[Bb]ad|[Ee]xit).+$ +prefregex = ^%(__prefix_line)s(?:\[\d+\] \w{2,3} [\d:\s]+)?(?:[Ll]ogin|[Bb]ad|[Ee]xit).+$ failregex = ^[Ll]ogin attempt for nonexistent user ('.*' )?from :\d+$ ^[Bb]ad (PAM )?password attempt for .+ from (:\d+)?$