Fwd: Patch: adjustment to saslauthd

---------- Forwarded message ----------
From: Pat Riehecky <[email protected]>
Date: Tue, May 27, 2008 at 11:51 AM
Subject: Patch: adjustment to saslauthd
To: [email protected]


The saslauthd system reports extra information about each failure.  On
my public mailserver people trying to brute force valid users (and
failing) for sending messages causes an extra few thousand lines each
day added to the logwatch summary telling me such useful things as user
AAAAB is not not in my LDAP server as well as login failure for user
AAAAB and invalid LDAP DN for AAAAB.  The attached patch suppresses the
extra errors and just reports that user AAAAB failed to login and how
many times they failed without telling me why.

Pat



-- 
Kirk Bauer <[email protected]>
http://linux.kaybee.org | www.logwatch.org
Author, Automating UNIX & Linux Administration

_______________________________________________
Logwatch-Devel mailing list
[email protected]
http://www2.list.logwatch.org:81/mailman/listinfo/logwatch-devel

--- saslauthd_orig	2008-05-27 10:31:58.000000000 -0500
+++ logwatch/scripts/services/saslauthd	2008-05-20 10:46:03.000000000 -0500
@@ -52,6 +52,10 @@
       $Startups++;
    } elsif ( $ThisLine =~ m/^server_exit     : master exited: \d+$/) {
       $Shutdowns++;
+   } elsif ($ThisLine =~ /Entry not found/) {
+     $AuthFailures++; $AuthFailures--;
+   } elsif ($ThisLine =~ /Authentication failed for/) {
+     $AuthFailures++; $AuthFailures--;
    } else {
       push @OtherList,$ThisLine;
    }