denyhosts exits (2) in MacOS X 10.8 (Mountain Lion)

[ktekinay (Kem Tekinay)]

denyhosts exits with error 2 in Mountain Lion. It loads, then abruptly exits without listing a reason in the log. This had been working flawlessly for years, and nothing has changed other than upgrading to Mountain Lion and upgrading MacPorts.

[nerdling (Jeremy Lavergne)]

Can you check the system log for other messages? I expect something like this should exist:

/usr/bin/awk: bailing out at source line 19

[ktekinay (Kem Tekinay)]

This is the entire message:

8/1/12 7:24:11.538 PM com.apple.launchd[1]: (org.macports.denyhosts[55148]) Exited with code: 2

There is nothing relevant before or after.

[nonstop.server@…]

Cc Me!

[nerdling (Jeremy Lavergne)]

Error code 2 means missing file, which points to you having not configured all the files as the port instructed upon installation.

Here's the port's messages, which you can call up anytime with port notes denyhosts:

Please read /opt/local/share/denyhosts/README.txt. You need to make config files in /opt/local/share/denyhosts; the files ending with '-dist' are examples for you to copy.

[ktekinay (Kem Tekinay)]

I will uninstall/reinstall DenyHosts then. As mentioned in the original report, this had been working flawlessly for years off the configuration I had put into the place originally, with the only change being the upgrade to ML and update of MacPorts. When DenyHosts launches, it has all the settings I put into the config file, so I know it's reading it. My only thought is that one of the upgrades munged one of the needed files.

Thanks.

[ktekinay (Kem Tekinay)]

I found the problem. DenyHosts previously worked by scanning the /var/log/secure.log, but, in Mountain Lion, there is no more secure.log. It's been rolled into the general logging utility asl so entries will only appear in system.log. To fix it, I had to add/modify these entries in the config:

SECURE_LOG=/private/var/log/system.log
USERDEF_FAILED_ENTRY_REGEX=.*?sshd\[\d+\]: error: PAM: authentication error for (?P<user>[^ ]+) from (?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}.\d{1,3})
USERDEF_FAILED_ENTRY_REGEX=.*?sshd\[\d+\]: error: PAM: unknown user for illegal user (?P<user>[^ ]+) from (?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}.\d{1,3})

I have not tested these yet to make sure it works as expected, but at least it doesn't exit on startup anymore.

[ryandesign (Ryan Carsten Schmidt)]

Re-opened as #38084.