Hi Geelsu!
The output in my current /var/log/secure doesn't seem to match what you're describing. Could you maybe give us a couple of sample lines, with a known and an unknown user?
Here's an example that may help. First, my log entries look like this:
Code:
## Bad user...
Jan 7 12:21:26 localhost sshd[7259]: Invalid user bob from 127.0.0.1
Jan 7 12:21:26 localhost sshd[7260]: input_userauth_request: invalid user bob
Jan 7 12:21:27 localhost sshd[7259]: pam_unix(sshd:auth): check pass; user unknown
Jan 7 12:21:27 localhost sshd[7259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=jwcos532-beta
Jan 7 12:21:27 localhost sshd[7259]: pam_succeed_if(sshd:auth): error retrieving information about user bob
Jan 7 12:21:28 localhost sshd[7259]: Failed password for invalid user bob from 127.0.0.1 port 53585 ssh2
Jan 7 12:21:29 localhost sshd[7260]: Connection closed by 127.0.0.1
## Good user...
Jan 7 12:27:36 localhost sshd[7459]: Accepted password for cchocula from 127.0.0.1 port 58892 ssh2
Jan 7 12:27:36 localhost sshd[7459]: pam_unix(sshd:session): session opened for user cchocula by (uid=0)
Jan 7 12:27:40 localhost sshd[7459]: pam_unix(sshd:session): session closed for user cchocula
We *could* just go by the 'invalid user' pattern, but it looks like I get two of those per attempt. Invalid users on my system always produce a line with 'input_userauth_request: invalid user username', so we can get the bad user this way:
Code:
for UNKNOWN_USER in $(awk '/input_userauth_request/ {print $NF}' /var/log/secure); do
echo "LOL, some noob tried logging in as $UNKNOWN_USER..."
done
## test output from the log snippet posted above:
## LOL, some noob tried logging in as bob...
While valid users produce an 'Accepted password' line that we can use:
Code:
for KNOWN_USER in $(awk '/Accepted/ {print $9}' /var/log/secure); do
echo "$KNOWN_USER just logged in... neato."
done
## test output from the log snippet posted above:
## cchocula just logged in... neato.
I hope this helps! If you have a few lines from that log we can probably give you a more specific example.
-J
