Created a ueiMatch for 'Authentication refused' sshd syslog message + a corresponding event definition.

'Authentication refused' messages are issued when openSSH tries to use public keys based authentication and
the related configuration files don't have the proper permission.

From sshd's man page:

     ~/.ssh/authorized_keys
             Lists the public keys (DSA/ECDSA/RSA) that can be used for logging in as this user.  The format of this file is described above.  The content of the file is
             not highly sensitive, but the recommended permissions are read/write for the user, and not accessible by others.

             If this file, the ~/.ssh directory, or the user's home directory are writable by other users, then the file could be modified or replaced by unauthorized
             users.  In this case, sshd will not allow it to be used unless the StrictModes option has been set to “no”.

I think this message is important because public key based authentication is often used for unattended machine-to-machine communication. So, you probably want to know when these communications don't occur as expected.

Cyrille Bollu