src/etc/periodic/security/800.loginfail

[Dmitry Pryanishnikov]

Hello!

  I've noticed the recent addition in this file in order to detect
"(fail|invalid|bad|illegal)" in auth.log files. I wonder would it be useful
to also detect SSH.COM's server "Refusing connection" messages here. They have 
the following format:

Mar 16 14:56:55 test3 sshd2[74522]: Refusing connection from "192.168.1.145". 
Too many open connections (max 2, now open 2).


Sincerely, Dmitry
-- 
Atlantis ISP, System Administrator
e-mail:  dmitry at atlantis.dp.ua
nic-hdl: LYNX-RIPE