--- logwatch/scripts/services/sshd 2009-08-11 21:59:52.000000000 +1000 +++ sshd 2009-07-27 22:14:54.000000000 +1000 @@ -342,6 +342,14 @@ $LockedAccount{$User}++; } elsif ( my ($User) = ($ThisLine =~ /^User ([^ ]*)( from [0-9.]*)? not allowed because not listed in AllowUsers/)) { $AllowUsers{$User}++; + } elsif ( my ($User) = ($ThisLine =~ /^User ([^ ]*)( from [0-9.]*)? not allowed because listed in DenyUsers/)) { + $AllowUsers{$User}++; + } elsif ( my ($User) = ($ThisLine =~ /^User ([^ ]*)( from [0-9.]*)? not allowed because not in any group/)) { + $AllowUsers{$User}++; + } elsif ( my ($User) = ($ThisLine =~ /^User ([^ ]*)( from [0-9.]*)? not allowed because a group is listed in DenyGroups/)) { + $AllowUsers{$User}++; + } elsif ( my ($User) = ($ThisLine =~ /^User ([^ ]*)( from [0-9.]*)? not allowed because none of user\'s groups are listed in AllowGroups/)) { + $AllowUsers{$User}++; } elsif ( ($User) = ($ThisLine =~ /^User ([^ ]*) not allowed because shell (\S+) does not exist/)) { $NoShellUsers{$User}++; } elsif ( my ($IP) = ($ThisLine =~ /^scanned from ([^ ]*)/) ) {