Fwd: logwatch services/secure rsh patch.

And RSH lives on! :)

---------- Forwarded message ----------
From: James Tanis <[email protected]>
Date: Sat, 24 Mar 2007 14:57:06 -0400
Subject: logwatch services/secure rsh patch.
To: [email protected]
Cc: [email protected]

Hi Kirk,

I have a patch for logwatch's services/secure script which matches some
otherwise unhandled RSH lines (at least in FC5). Why am wasting your time
for *RSH*? Because some idiots (like me) still use it for ancient crap like
rdist. If you're developing a picture of me in your head as a crotchedly
old geezer with a walker, you're pretty much dead on.

At any rate this patch matches the pam_rhosts_auth "allowed" line. It may
well be that, instead of being added after the line that preceeds it, it
should simply replace it, but I really don't know that much about the
default rsh /var/log/secure lines.

     ----------------------------------------------------------------

--- /usr/share/logwatch/scripts/services/secure	2007-01-16
04:30:27.000000000 -0500
+++ ./secure	2007-03-24 14:40:03.000000000 -0400
@@ -113,6 +113,7 @@
    if (
       ( $ThisLine =~ /pam_succeed_if: requirement "uid < 100"
(was|not) met by user /) or
       ( $ThisLine =~ /pam_rhosts_auth\[\d+\]: allowed to [^ ]+ as \w+/) or
+      ( $ThisLine =~ /pam_rhosts_auth\([^\)]+\): allowed to [^ ]+ as \w+/) or
       ( $ThisLine =~ /^(.*)\(pam_unix\)/) or
       ( $ThisLine =~ /pam_unix\(.*:.*\)/) or
       ( $ThisLine =~ m/^[^ ]+\[\d+\]: connect from localhost$/ ) or


     ----------------------------------------------------------------

I'll also attach it below (attachments! Hah! Crazy newfangled
nonsense. Don't hold with it! No sir! [dang! my dentures just fell out
again]).

Cheers,
/jtt
[email protected]




-- 
Kirk Bauer <[email protected]>
http://linux.kaybee.org | www.autorpm.org | www.logwatch.org

_______________________________________________
Logwatch-Devel mailing list
[email protected]
http://www2.list.logwatch.org:81/mailman/listinfo/logwatch-devel

--- /usr/share/logwatch/scripts/services/secure	2007-01-16 04:30:27.000000000 -0500
+++ ./secure	2007-03-24 14:40:03.000000000 -0400
@@ -113,6 +113,7 @@
    if (
       ( $ThisLine =~ /pam_succeed_if: requirement "uid < 100" (was|not) met by user /) or
       ( $ThisLine =~ /pam_rhosts_auth\[\d+\]: allowed to [^ ]+ as \w+/) or
+      ( $ThisLine =~ /pam_rhosts_auth\([^\)]+\): allowed to [^ ]+ as \w+/) or
       ( $ThisLine =~ /^(.*)\(pam_unix\)/) or
       ( $ThisLine =~ /pam_unix\(.*:.*\)/) or
       ( $ThisLine =~ m/^[^ ]+\[\d+\]: connect from localhost$/ ) or