SSH monitoring

[Richard Emberson]

I've just installed pam_abl and tested it ... seems to work, but I've 
got a question.
I put the pam_abl line :

auth        required      /lib/security/pam_abl.so 
config=/etc/security/pam_abl.conf

in /etc/pam.d/system-auto. The problem is that at the top of the system-auto
file there is the warning:

# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.

Now my question, where can I put the pam_abl line so that it gets 
automatically
placed into system-auto each time authconfig is run?

Thanks
RME


Neil Cherry wrote:

> CHAT KHODA wrote:
>
>> Dear friends,
>> I wish to :
>>
>> 1- Monitor all of the connections(or tries) to my SSH
>> port including the source IP address.
>
>
> permit() {
>     # I want to log just the startup of the conversation
>     /sbin/iptables -A INPUT -s ${1} -p tcp --dport 22 -j LOG --syn \
>                    --log-level  info --log-prefix "iptables permit: " \
>                    --log-ip-options
>     /sbin/iptables -A INPUT -s ${1} -p tcp --dport 22 -j ACCEPT
> }
>
>
> # Deny these sites access to my machine
> deny() {
>     /sbin/iptables -A INPUT -s ${1} -p tcp --dport 22 -j LOG \
>                    --log-level alert --log-prefix "iptables deny: " \
>                    --log-ip-options
>     /sbin/iptables -A INPUT -s ${1} -p tcp --dport 22 -j DROP
> }
>
>
> # =[ Flush the tables completely 
> ]============================================
> /sbin/iptables -F
>
> # =[ Permit list 
> ]============================================================
> #permit 127.0.0.0/8             # Local stuff
> permit 10.0.0.0/8               # Local stuff
> permit 172.16.0.0/12            # Local stuff
> permit 192.168.0.0/16           # Local stuff
>
> # =[ Deny list 
> ]==============================================================
> deny 0.0.0.0/0          # Deny everyone else
>
> The logging part is probably what you want most but the above may
> prove to be useful.
>
>> 2- Limit the numer of unsuccessfull attempts to login
>> to just two attempts per session.
>
>
> Take a look at pam_abl ( http://www.hexten.net/pam_abl/ ). Now that
> i use the above I've had no incidents of needing pam_abl. That doesn't
> mean I won't.
>


-- 
This email message is for the sole use of the intended recipient(s) and 
may contain confidential information.  Any unauthorized review, use, 
disclosure or distribution is prohibited.  If you are not the intended 
recipient, please contact the sender by reply email and destroy all 
copies of the original message.