diff options
| author | zeripath <art27@cantab.net> | 2021-06-28 18:05:27 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-06-28 13:05:27 -0400 |
| commit | f825f20d49e8ba3a2cac58528a5dd40717585bb6 (patch) | |
| tree | ddb59c5dfaa25cd20fcaf26626da86e96b1fb0fa /modules/ssh | |
| parent | 5c80ecc2f75cd2948679abb31798b5da6baee698 (diff) | |
| download | gitea-f825f20d49e8ba3a2cac58528a5dd40717585bb6.tar.gz gitea-f825f20d49e8ba3a2cac58528a5dd40717585bb6.zip | |
Upgrade Gliderlabs SSH to 0.3.3 and add FailedConnectionCallback (#16278)
* Upgrade Gliderlabs SSH to 0.3.3 and add FailedConnectionCallback
Following the merging of https://github.com/gliderlabs/ssh/pull/143 we
can now report connections to the ssh server that have failed before
public key exchange has completed using the standard fail2ban message.
This PR updates Gliderlabs SSH and adds a callback that will provide this
logging.
Signed-off-by: Andrew Thornton <art27@cantab.net>
* move the callback to its own function to make the logging appear little nicer
Signed-off-by: Andrew Thornton <art27@cantab.net>
Diffstat (limited to 'modules/ssh')
| -rw-r--r-- | modules/ssh/ssh.go | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/modules/ssh/ssh.go b/modules/ssh/ssh.go index 22683b003b..bcaae5a180 100644 --- a/modules/ssh/ssh.go +++ b/modules/ssh/ssh.go @@ -12,6 +12,7 @@ import ( "encoding/pem" "fmt" "io" + "net" "os" "os/exec" "path/filepath" @@ -239,6 +240,15 @@ func publicKeyHandler(ctx ssh.Context, key ssh.PublicKey) bool { return true } +// sshConnectionFailed logs a failed connection +// - this mainly exists to give a nice function name in logging +func sshConnectionFailed(conn net.Conn, err error) { + // Log the underlying error with a specific message + log.Warn("Failed connection from %s with error: %v", conn.RemoteAddr(), err) + // Log with the standard failed authentication from message for simpler fail2ban configuration + log.Warn("Failed authentication attempt from %s", conn.RemoteAddr()) +} + // Listen starts a SSH server listens on given port. func Listen(host string, port int, ciphers []string, keyExchanges []string, macs []string) { srv := ssh.Server{ @@ -252,6 +262,7 @@ func Listen(host string, port int, ciphers []string, keyExchanges []string, macs config.Ciphers = ciphers return config }, + ConnectionFailedCallback: sshConnectionFailed, // We need to explicitly disable the PtyCallback so text displays // properly. PtyCallback: func(ctx ssh.Context, pty ssh.Pty) bool { |